Mark, thanks for your report with clear steps to reproduce. Increasing priority and hoping this issue can be fixed soon.

just linking a similar issue.

Hello, I created two patches [1], [2] to allow only group members to edit the Wiki in 'visible groups' mode.

[1] - In this patch the edit tab is not disabled, i.e., when a group member changes group to 'other group' the edit tab still shows up (though, he/she is not allowed to edit the same).
This patch has no dependency on the fix for MDL-26577.

[2] - In this patch the edit tab is disabled, i.e., when a group member changes to 'other group' the edit tab does not show up (as he/she is not allowed to edit the same. Care has been taken to allow, users with capability - mod/wiki:manage 'and' mod/wiki:editpage to be able to edit the same.)
This patch has dependency on the fix for MDL-26577. If the members toggle between the groups the edit tab will not be disabled/enabled but restores to the required on a page refresh.

[1] - https://github.com/mayankgupta/moodle/commit/98f493f6e69a090355efa3bd70e01d5242a79d21

[2] - https://github.com/mayankgupta/moodle/commit/2eaf4b36acc0c3efd2af8d16a47ea0732beb5a42

I will be happy to modify it, if required.

Thanks,
Mayank.

Mayank, thanks for your patches. Adding groups expert Petr as a watcher and hoping he has chance to review the patches.

Helen, Thanks for adding Petr. As discussed with you, while writing the patch above I noticed a couple of more issues with the Wiki in visiblegroups.
To reproduce the issues -
1. Create a Wiki, in 'visiblegroups' group mode and Wiki mode individual or collaborative.
2. Just 'save and return', do not create subwiki pages.
3. Login with a student enrolled in a group say A.
4. Switch Group to 'othergroup' say Group B, the student can create a wiki page for 'other group' B. (For wiki in collaborative mode). It should not be able to create a page for the 'other group'.
5. If wiki is in individual mode, the student can then also create a wiki page for 'other students'.

I have worked on a patch for it -

https://github.com/mayankgupta/moodle/commit/95fa6fddca66a30ca659011b6699d6efe121e144

Thanks,
Mayank.

After a few minutes I have discovered a lot more issues in mod/wiki, I am sorry I have to give up because it is in my opinion not fixable. The details are described in MDL-27218 (security issue with restricted access, sorry).

Petr

Mark, Thanks for your report. I posted a similar one (MDL-27306) before realising it duplicated your report.

Personally, I think the priority of this issue should be promoted to 'Blocker'. This issue, coupled with the fact that wiki pages can't be deleted (MDL-27335) makes the Wiki module even less viable.

Despite its problems, at least the standard wiki module in 1.9 allowed for this 'core feature' (i.e. the ability of groups to edit a single wiki but not that of other groups). To have it taken away is seriously disappointing.

Increasing priority as suggested.

Reviewing the patch provided
https://github.com/mayankgupta/moodle/commit/95fa6fddca66a30ca659011b6699d6efe121e144

Looks like this bug was originated during the changes introduced in the wiki during its move to core. We can either take back our code from may 2010 or apply the patch provided
at
https://github.com/mayankgupta/moodle/commit/95fa6fddca66a30ca659011b6699d6efe121e144
We have reviewed it and it work fine pus solves another bug related.

This issue is affecting MP clients. Please give it priority.

Patch https://github.com/mayankgupta/moodle/commit/95fa6fddca66a30ca659011b6699d6efe121e144 seems to be good and solving the issue, hence pushing it for integration review

This has been cleaned, cherry-picked onto 20, 21 and master. Up for testing.

This fixes the editing problems. It is no longer possible to edit a page that is in another group. Tested in 2.2

Yes, you got this finally upstream, just in time for Moodle 2.2beta. Congrats and thanks!

Ciao

Thats great!
Thanks all for integrating, testing and closing the issue!

Hi MichaeldR,
perhaps a comment would be useful here when we remove security statuses for closed issues. Otherwise it just seems so out of the blue.
cheers,
Aparup

Sorry, I should have commented earlier. I am currently preparing the security releases and reflecting on security releases.

I've converted this to an issue on its own and removed the security as it is minor compared to the other wiki issues that it was reported with, and also in relation to the other issues that will be reported in the security release.

Apologies for the confusion.

Thanks Michael.

We try to use this fix in our version 2.1.2 and when testing, the edit option in the menu is now gone but not the one in the navigation menu. It is normal ?

Hi Gilles-Philippe Leblanc
certainly does not seem normal to me - i've created MDL-31708

Linking created issue, thanks for the report Gilles !

No problem! Thank you for creating the new task. I do not have much time to spend but I will still try to see if I can fix this quickly.