If user has no "create" access for any of the terms in a required vocabulary, they can still create. The resulting node won't have any term in the vocab. Not sure if this was introduced in the 2.x branch, or if it is also present in 1.x.

CommentFileSizeAuthor
#5 taxonomy_access_required_or_free_0.patch1.05 KBedrex
#4 taxonomy_access_required_or_free.patch1.05 KBedrex
#2 taxonomy_access_24.patch1.06 KBkeve

Comments

edrex’s picture

edrex commented

I think the problem is that taxonomy's submit handler for the node form says "hmm this vocabulary doesn't appear to have any terms in it... it's silly to 'require' a vocab with no terms" and lets the submit pass. Looking at ways around this. I think this bug must be present in 1.x branch, still untested.

keve’s picture

keve commented
StatusFileSize
new taxonomy_access_24.patch1.06 KB

I made a patch, which avoid hiding of required vocabularies.
What do you think?

TODO: But I think there is still a problem when a required vocabulary is free-tagging:
User can submit a node without validation error, when leaving the required free-tagging vocabulary empty. (Vocabulary is required but user have no create permission)

xolotl’s picture

xolotl commented

Seems like using a freetagging vocabulary for access control raises a lot of issues.

Maybe better to not allow freetagging on TAC vocabularies?

Or does this issue also apply to vocabularies that are *not* used for access control?

edrex’s picture

edrex commented
StatusFileSize
new taxonomy_access_required_or_free.patch1.05 KB

right now, since it's not doing anything at validate time, any term is allowed for freetag vocabs. The only problem AFAIK is this case:

  • Freetagging vocab
  • NOT required
  • User doesn't have "create" for any terms in the vocab (either by a vocab-wide rule or by per-term rules)

In this case, the form element for that vocab will be hidden, so that the user won't be able to create any new terms.

For now how about we just bow out of the "controlling create for free vocabs" business?

I've attached a modified version of keve's patch that lets all free vocabs through. The effect should be that "create" perms don't do anything for free vocabs. We could add a validate for that later, as keve mentioned in an email.

edrex’s picture

edrex commented
StatusFileSize
new taxonomy_access_required_or_free_0.patch1.05 KB

fixed an infinite loop (i guess db_result doesn't auto-increment through the result set, not very useful). New patch attached. We should update the docs to say that free-tagging vocabs aren't currently supported.

committed to 5.x-2.x.

edrex’s picture

edrex commented
Version: 5.x-2.x-dev » 5.x-1.x-dev
Assigned: edrex » Unassigned

seems good on 2.x, want to apply to 1.x?

keve’s picture

keve commented

Well, normally i am not planning to make version 5.1.1. Maybe we should tag 5.2.dev branch soon, as official 5.2. What do you think?

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Closed (fixed)

My guess is "no" on the 1.x branch, and that (hopefully) the 2.x branch will be getting its release tag one of these days. :)