I'm hoping I can get some assistance for this. I am trying to set up a wiki site, and have a content type 'Wiki' where users can select one of two vocabulary terms: Public or Private. Public should be viewable by anyone but Private should be restricted to users of the site.

The problem is that no matter what I do, Anonymous users always have access to both taxonomy categories. I've included a screen shot of my permission rules for the Anonymous role. The instructions I read said that the permission "View published content" must be enabled for that role, so it is. I have also tried turning that access off though with no success.

rules for Anonymous role

Thanks ahead for any assistance.

CommentFileSizeAuthor
TAC.jpg125.3 KBPuxapuak

Comments

frankiedesign’s picture

frankiedesign commented
Version: 7.x-1.0-rc1 » master
Component: User interface » Code
Category: support » bug
Priority: Major » Critical

This is a severy security problem, as it WILL expose all content of the website to anonymous users.
You should put a WARNING-BANNER on the front page of this project, so that people don't run into legal issues.

This IS a big problem. You DEFINITIVELY should stop working on anything else and fix THIS!!

Myddna’s picture

Myddna commented

Subscribing, I'm interested.

juggledean’s picture

juggledean commented

Is this bug also in 7.x-1.0-rc1 or only in the master version?

tmin’s picture

tmin commented
Issue summary: View changes

I face the exact same issue in 7.x-1.0-rc1. Is it possible that this may be a conflict with another module that handles permissions (aka taxonomy_access is blocking the access but the other module allows it)? It seems too obvious to be an actual bug that occurs in every case.

I will try to reproduce it in a clean development environment and if I fail to do that I will duplicate my production environment locally and see which module messes up with taxonomy_access.

UPDATE:

I tried to reproduce the issue in a clean environment and I wasn't able to. After some digging, I realized that there was a permission in "Content Access" module that allowed every user to see the nodes of the specific content type.

In case someone else comes across this problem, one way to troubleshoot it is to grep -R "node_access" in your default modules' directory (usually sites/all/modules) and see what other modules are invoking the specific hook and may be causing the issue. Then check the settings of the modules that are indeed invoking hook_node_access.

tmin’s picture

tmin commented
Status: Active » Closed (works as designed)

I suggest that this issue is closed since there is no way for TAC to control what other modules are doing with hook_node_access. The issue does not occur (/cannot be reproduced) when no other module is invoking the node_access hook.