It seems that some Category Permissions get overridden by some settings in regular role permissions to cause some odd behaviors.

For example, I have an "administrator" role and then I have a forum to which I want to restrict access. What I notice is the following. People not in the "administrator" role can not see the forum. This is good and to be expected.

However under Category Permissions for the "administrator" role I am not allowing any of the options for the forum (so no view, update, delete or create privs), and that's where the fun begins.

Under regular role Permissions of for "adminstrator" I enable "administer nodes" in the "node module" an adminstrator can then see and post in the forum that they should not have access to according to the Category Permissions for that role. If I disable this then the Category Permissions prevent them from seeing posts in this forum.

And if I enable "administer taxonomy" in the "taxonomy module" and administrator can see the forum, and post in the forum but not see the actual posts once they're in the forum (provided that "administer nodes" is turned off -- see above).

If both the above options are on, no matter what the Category Permissions are, the forum will be available to them for use.

It just seems off that these two things allow this. Category Permissions should always override other node related permissions should they not?

Comments

pyromanfo’s picture

pyromanfo commented

No, they shouldn't. If you don't want someone to be able to administer all the nodes on the site, don't give them "administer nodes" permission. Same goes for taxonomy. That's the point, when you let someone "administer nodes" that means all the nodes. It superscedes any category/node based permission. That's by design.

If you want to let them edit nodes only in specific categories give them the "update" permission for that category and not "administer nodes".

circeus’s picture

circeus commented

Fine I can accept that its intent is by design.

But it still seems to me that its a bug that they can add comments to a node but not see them when "administer taxonomy" is set and "administer nodes" is not set while the category permissions are completely unset for that node's taxonomy.

pyromanfo’s picture

pyromanfo commented

Yeah, it is confusing. However that's really a core issue, and has more to do with what permissions "administer taxonomy" are supposed to represent. I'd take it up with them to possibly add more explanation for that permission, perhaps it already is explained in the docs somewhere. This has nothing to do with my module however, since category permissions are only checked after the other permissions, and that's by design.

Also if you accept that it's by design, please don't change it back to active.