I have a basic one-level taxonomy set up in Drupal 5.1. Nodes may have multiple terms associated. I’ve got the latest dev snapshot of TAC lite as of 5/28/2007.

I have created TAC lite rules to say that anonymous and authenticated users have access to most, but not all, terms in my taxonomy. Higher level roles have access to the otherwise-restricted terms.

I create a node (a story) with two terms associated. One of the terms is allowed to be seen by both anonymous and authenticated users, but the other is restricted. In testing this, an anonymous user is able to see the entire node on the front page and see the non-restricted term associated with it, but does not see the restricted term.

In effect, one non-restricted term overrides the access denied to the restricted term. Yes, the term itself cannot be seen, but associating a restricted term with a node doesn’t deny access to the node.

I did not expect this behavior. Instead, I expected that the restricted term associated with the node would prevent the node from being viewed by anonymous and authenticated users; only other roles with the correct permissions would be able to see those nodes.

Is this a design decision or limitation of this module? I can’t find a way to configure it differently, to deny access by term even when other unrestricted terms are associated with the node.

Thanks!

Comments

jaharmi’s picture

This behavior persists even after I Rebuild Permissions under Administer > Content Management > Post Settings.

Dave Cohen’s picture

Status: Active » Closed (won't fix)

in Drupal, access to nodes is always granted, never denied. So by tagging the node with a term the user has access to, they are able to see the node. It's the nature of Drupal's node access infrastructure.

Some of the other node access modules out there might try to change this, but that seems like an uphill battle to me. Certainly not in the spirit of tac lite .

Remember that not all vocabularies have to effect privacy. I'll bet you can change your tagging scheme just a bit and find a way to make it work.