The delete permission doesn't seem to be checked for anywhere in the code.

Is it at all relevant, though? If a user can add a node to a category, why shouldn't he/she be able to remove it from that category? It would make sense to just merge this with the update permission.

Comments

sulleleven’s picture

sulleleven commented

you can delete what you publish, no matter.

pyromanfo’s picture

pyromanfo commented

If other modules aren't checking node_access before deleting, that should be taken up with their modules. I haven't tried it, myself.

Also, this module doesn't give users automatic access to delete items they create, if they hardcoded this in core I don't know, as I haven't tried it, but this module doesn't give them access if nothing else does. Most forums of any decent size don't allow users to delete their own posts, for instance.

G-LiTe’s picture

G-LiTe commented

I was wrong on the original bug report: I wasn't aware the taxonomy_access function was also acting as hook_access for the taxonomy module.

This brings me to something else though (maybe I should open a separate bug report for this):
Because there's no permission for insert, there's no way to check whether the insert operation is allowed. Users can currently post to a forum, but it'll end up in none of the categories, because the term_data record is not inserted in taxonomy_node_save.

pyromanfo’s picture

pyromanfo commented

Update acts as the create permission, however taxonomy.module only checks the view permission when creating the user form for selecting categories. So if they have view, they can see them for selection in the category select form, but they can't put anything there.

G-LiTe’s picture

G-LiTe commented

taxonomy_access only checks the update operation though, when it's called as a hook_access, and not the insert operation. While taxonomy_nodeapi calls taxonomy_node_save for both insert and update operations. Meaning in the latter case, the update permission is checked for insert, but in the former it isn't.

pyromanfo’s picture

pyromanfo commented

Oh, I'll have to take a look at that. I'm adding a "create" permission, so when I do that I'll fix this to check that new permission in every instance. Thanks for catching it.

pyromanfo’s picture

pyromanfo commented

Check to see if this is fixed in CVS. Basically there are two places the permission this is checked now. In the taxonomy select form that you get under "create content" and in taxonomy_node_save.

This way, the user using create content (or quickpost, another module of mine) won't even see the categories to post to, and if there's some module out there that's not checking with taxonomy_access before letting users post to a category (such as forum.module), then the node won't actually end up in the category. I think this is the behavior you're describing with the forums, in which case you do need to talk to the forum.module guys to see if they can add taxonomy_access support to their "Submit Forum Topic" page. Really they just need to check with taxonomy_access's new "create" permission before outputting the "Post new forum topic" link.

pyromanfo’s picture

pyromanfo commented
Anonymous’s picture

(not verified) commented