Drupal - access errors

Our Drupal 7 site recently stared displaying 'access denied' errors when displaying a page with H5P content,

A check of the log showed the url causing the error is apparently from an ajax call - a typical url looks like: http://copyoftest7.site.edu/h5p-ajax/content-user-data/15752/state/0 - all of the 'access denied' errors have a 'h5p-ajax/content-user-data/(node)/state/0' pattern.  The content displays without any problem.

We enabled the 'trim trailing zero' option in the global redirect module, which changed the error from 'access denied' to a 'page not found', a slight improvement but not the solution.  So before I dig into the code I'm opening this thread for any ideas anybody might have.  Thanks in advance.

fnoks's picture

This ajax call is run whenever user data is saved or fetched. It is run even if the user is not logged in, but the Drupal endpoint requires the user to be logged in, therefore it fails with access denied. This will not have any other consequences than the js-error message displayed in the browser.

I have created an issue for this - hopefully a fix will be part of the next release!

Thanks for reporting!

It turns out the 'save content state' setting, in config/system/h5p, has to be set.. it was reset in our case.

AFter enabling the setting (and turning off the trailing zero trimming in global redirect, see above) everything has returned to normal.  Sorry for the panic post, too, and I imagine there will be others who will follow in my path and may benefit from my few hours of painfully aquired wisdom. 

Thanks again for your help!

fnoks's picture

Then probably my previous comment was not correct. Anyways, we now have an issue in our backlog to figure out what was going on here so that others don't have to experience the same problems!

Thanks for the follow-upWe are thankful for all feedback - it makes H5P better!

It turns out that the above fix may not completely eliminate the problem, (ie, access denied errors while running H5P modules).  The errors appeared again after enabling organic groups, and turning off the 'organic groups - field access' setting stopped the error.  

These errors have been happening only for Anonymous users, authenticated permissions and above run error-free.  Matching permissions (anon users boosted to match auth) does not affect the problem.  Also, the page may have to be refreshed after first load to induce the error, and the error may appear on the following page upon load if you click away.

Now that I have a better scope of the problem I'll start digging in, I'll keep you posted.  And if any readers have any experience with this little enigma, let me know..  I'm a relative newb w/ Drupal and I'm "learning by undoing" here. =]

falcon's picture

Thank you for sharing your experiences. We will make a change so that there will be not requests to that url if the user isn't logged in in an upcoming version of the module.

Hi, I am having problems with accessing h5p content for anonymous users as well as authenticated users in drupal. Every other content type works, but I am having problems with interactive content. I am always getting the 'You are not authorized to access this page'. So far, only the siteadmin can access interactive content. I might have overlooked something, I suppose? Any help?

falcon's picture

You might be using quiz_h5p? That module seems to mess up access control in Drupal in some cases, but we haven't got precise information on what causes this to happen yet.

Would you advice me to disable the Quiz H5P Integration module and use H5P as a stand-alone instead?

falcon's picture

If you need Quiz's features you should raise an issue in the relevant Drupal.org issue que. If not you could use H5P standalone.

Thank you for your answer!