While the module does successfully block display of restricted terms on the site itself, the feed of the same page reveals all nodes, no matter what their access level. I experienced this with blog entries on a business site. Confidential posts have been routinely fed out via RSS to anyone who bothered to subscribe to the blog/feed.

I consider this a critical bug because it essentially makes taxonomy_access useless.

Drupal 4.5.2.
Taxonomy_access.module v. 1.11 (latest for 4.5)

The feeds are all default feeds offered by the taxonomy.module (patched). No other taxonomy modules have been installed.

I hope a remedy can be found quickly. As it is, I had to unpublish the private nodes.

Comments

pyromanfo’s picture

pyromanfo commented

Could you give more details? When I try it on my test site (I have a term with view access restricted to anonymous users), I get a 403 forbidden error from the site. I can read the RSS feeds of the public terms just fine, but when I try to read them from the private term I get the 403 error.

You do have the taxonomy.module patched right?

pyromanfo’s picture

pyromanfo commented

And sorry about me taking so long to take a look at this.

media girl’s picture

media girl commented

More particulars. This is the patch that has been applied to taxonomy.module:

--- /root/drupal-4.5.0/modules/taxonomy.module	Mon Oct 18 12:46:19 2004
+++ /var/www/modules/taxonomy.module	Mon Nov  8 00:14:33 2004

I must clarify and correct my original report:

I am unable to get the restrcted term's RSS feed to load, unless I am logged in with access. So far so good. BUT....

If that post appears in ANY other feed, it is viewable by RSS. So if it's a blog post, it will show up in the blogs feed. If it's promoted to the front page, it becomes part of the main feed.

Obviously this can be problematic when a LOT of posts end up available by other feeds. I have not tested this with the other various supplementary taxonomy modules that provide additional feed options.

I hope this additional info helps.

pyromanfo’s picture

pyromanfo commented

Oh okay. That's a bit of a problem then.

Because basically I'm telling all the other modules through the node_access hook that those nodes shouldn't be viewable. And they're not even bothering to check.

So while the core taxonomy feeds work fine, the blog feed, or the front page feed aren't checking the node_access table when putting out the RSS feed. I believe the front page feed is core, so that's a bug they'll probably fix pretty easily. If the blog.module is core, they may fix that pretty quickly too. Otherwise you may need to ask whoever does the blog.module to add it.

Post a list here and let me know who you've filed issues with and I'll go give them more info, since as you say this is a pretty big hole. But I can't really fix it with my code, so they'll have to do it.

It is good to know exactly what's going on, so other people can watch for this stuff. Let me know of any RSS feeds that don't honor the node_access table, I'll try to help where I can.

media girl’s picture

media girl commented

Thanks for the response! So far I've not posted this as an issue anywhere else.

the_monkey’s picture

the_monkey commented

I just posted a bug a couple days ago regarding this (http://drupal.org/node/29971 ) as I did not see this post the first time. Does anyone know if this has been fixed, addressed, worked around yet?

-m

tostinni’s picture

tostinni commented

Can you describe us the way to reproduce this ?
I just did that :
- enable blog
- post a blog entry as admin promoted to front page
- disconnect myself
- go to front page as anonymous : the blog entry doesn't appear, neither in node/feed nor blog/1/feed
So I can't reproduce it.

Of cours I got a 4.6.3 install with taxonomy access set up. Grants are given to anonymous to categories, but as I post my blog entry without category, and that anonymous doesn't get access to this, he can't see it.

keve’s picture

keve commented
Version: » 4.6.x-1.x-dev
keve’s picture

keve commented

I could not reproduce the problem.
Can someone check it if it is still exist?

keve’s picture

keve commented
Status: Active » Closed (fixed)

This a year old bug. The whole TAC module has been improved a lot.
Whitout more user comments, i close this issue.