Geonode: Group membership is ignored for layer permissions

[sjohn-atenekom]

Expected Behavior

An uploaded layer with view permission set to a group, should be visible by group members.

Actual Behavior

The layer can't be accessed by the user. Permission denied.

I already did some investigation, but I'm sure where the error is. The method geonode.utils.resolve_object() makes use of of the django.contrib.auth permission system:

allowed = request.user.has_perm(
                    permission,
                    obj_to_check)

if this is correct, then the error might be in the missing synchronisation of the groupprofile membership and the membership of django.contrib.auth groups. Whenever a user is added to a group profile, she/he is not automatically member of the django.contrib.auth group.

Steps to Reproduce the Problem

1. Upload layer
2. set view permission to group "testgroup"
3. add non-admin user to groupprofile "testgroup" as a member
4. login as non-admin user
5. Open localhost/layers
6. the uploaded layer should be visible

Specifications

• GeoNode version: 2.10.x
• Installation method (manual, GeoNode Docker, SPCGeoNode Docker): GeoNode Docker
• Platform: Debian
• Additional details:

[afabiani]

@sjohn-atenekom I just did a try on master demo (version 2.10.x) and could not replicate this
I used a private group and added a member (non-superuser) to this
Changed the permissions and tested with both anonymous and members
and it works as expected

[sjohn-atenekom]

Thanks for testing, @afabiani. Thats strange. I set up a fresh GeoNode from 2.10.x branch. Is the group also listed on the profile edit page in the admin panel? (admin/people/profile) ?

[sjohn-atenekom]

Hi @afabiani, I found, what the issue actually is. When you create the group profile and add the user in the django admin panel the membership is not synced with the django.contrib.auth group. But when you add the user in the frontend of geonode the membership gets synced. This is done by the join() method of model groupprofile.

Therefore, I propose adding a save()-method in class GroupMember, which will add the django-group to the user profile and removing this logic from the groupprofile,join() method.

[afabiani]

@sjohn-atenekom can you take care of this?

[sjohn-atenekom]

yes, i will provide a PR soon.