I force users to select a term from a vocabulary on upload. I want to allow a certain role to select only one particular term out of the vocabulary (other roles can select any of the terms). This seems like a perfect job for TAC. However, I have been unable to restrict term selection on node creation. I have taken screenshots of my TAC permissions and my node permissions; as you should see I want to allow the role in the far right column of the node permissions.

To reiterate: though it seems to me that this role should only be able to create content with the 'Senior speeches' term applied, users in this role can add any term from this vocabulary to content they create. It appears that TAC just isn't doing anything :/

6.22 w/6.x-1.3 FWIW; I disabled/re-enabled TAC to no effect. I haven't uninstalled/reinstalled it or uninstalled it/replaced it with -dev since the commits are so close together.

Any help would be deeply appreciated.

CommentFileSizeAuthor
#6 tax.png20.42 KBxjm
#6 tac.png48.12 KBxjm
#6 form.png16.04 KBxjm
#6 tac-with-parent.png48.08 KBxjm
#6 form-with-parent.png18.78 KBxjm

Comments

xjm’s picture

xjm
she/her
Primary language English
commented

So with the configuration above, the Senior Speeches Blog Moderator is able to select any term in the Primary Links vocabulary? Is that correct?

A couple questions:

  1. Any account with Senior Speeches Blog Moderator will also have the authenticated user role. Can you check that configuration, post a screenshot of the authenticated role config, and/or verify that no other roles are granting create permission to these accounts on this vocabulary?
  2. Is this a freetagging vocabulary? Freetagging vocabularies don't work with TAC (in part by their nature, and in part because of some outstanding issues).
  3. Do you have any modules or custom code altering the rendering of the taxonomy form on the node?

Also, there is an outstanding issue (#112307: Cannot create node in taxonomy term without create permission for parent term) that actually prevents create permissions from working without the parent term having permissions. So, the user would need create permissions on "Blog" as well if it were working as expected.

Alphabool’s picture

Alphabool commented

So with the configuration above, the Senior Speeches Blog Moderator is able to select any term in the Primary Links vocabulary? Is that correct?

Yes absolutely.

Any account with Senior Speeches Blog Moderator will also have the authenticated user role. Can you check that configuration, post a screenshot of the authenticated role config, and/or verify that no other roles are granting create permission to these accounts on this vocabulary?

In this permissions screen the authenticated user role is second from the left. If you don't want to look, it only has 'access content', 'delete own blog content', and 'edit own blog content' checked. I also tried unchecking the latter two but that made no difference.

Is this a freetagging vocabulary?

No.

Do you have any modules or custom code altering the rendering of the taxonomy form on the node?

I have Hierarchical Select installed but I tried disabling it (but not uninstalling it entirely) to no effect. I also have Override Node Options installed but I disabled it (again, didn't uninstall it) to no effect.

What is the expected behavior? Is this a hook_form_alter implementation or something different? Have you, or anyone else, been able to deny node creation in any case? I can't, even when I disable creation for all terms in a vocabulary....

Thank you very much for the help, xjm. Any further ideas you have would be tremendous.

Alphabool’s picture

Alphabool commented

bump

xjm’s picture

xjm
she/her
Primary language English
commented

You still have not provided me with a screenshot of your Taxonomy Access Configuration for authenticated users or a confirmation that they do not have create checked, or whether these users have any additional roles.

Alphabool’s picture

Alphabool commented

Authenticated users don't have 'create' checked: http://i.imgur.com/NGX2Q.png. Users with role 'Senior Speeches Blog Moderator' have no other role other than the base 'authenticated user'.

xjm’s picture

xjm
she/her
Primary language English
commented
StatusFileSize
new form-with-parent.png18.78 KB
new tac-with-parent.png48.08 KB
new form.png16.04 KB
new tac.png48.12 KB
new tax.png20.42 KB

I still cannot duplicate this. :( I have my test environment configured to match your setup:

With this setup, no terms are listed, because the role does not have create permissions for the parent term:
Content type submission form

When I add the Create grant to the "Blog" term, the role is properly granted access only to that and the child term:

There are only two other things I can think of, and I'm sort of grasping at straws at this point:

  1. Does this role somehow have "administer taxonomy" permission? That is the only permission that could make a difference that is not visible in your screenshot.
  2. What is the URL of your node add/edit forms? Is it something different from node/add/type or node/123/edit?

(Edit: Note that the account does not actually have Update grants in the screenshots here, but I was testing at node creation anwyay, and I confirmed that granting or removing update did not alter the behavior.)

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Postponed (maintainer needs more info)
xjm’s picture

xjm
she/her
Primary language English
commented

Please provide steps to reproduce from a clean install, since I cannot reproduce this.

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)
Alphabool’s picture

Alphabool commented

I am glad to be able to say that after returning to this problem a few months later, I created a whole slew of new roles and applied granular TAC permissions with success! The bizarre thing is that the role that I was having trouble with still refused to behave, but once I deleted it and replaced it with a new role with the exact same settings it worked! Sorry to cause you all that trouble, xjm.