Here the permission is called "update terms in":

  /**
   * Implements \Drupal\Core\Entity\EntityAccessControllerInterface::updateAccess().
   */
  public function updateAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) {
    return user_access("update terms in {$entity->bundle()}", $account) || user_access('administer taxonomy', $account);
  }

and here it's called "edit terms in":

    $permissions += array(
      'edit terms in ' . $vocabulary->id() => array(
        'title' => t('Edit terms in %vocabulary', array('%vocabulary' => $vocabulary->name)),
      ),
    );

shouldn't this be both update?

Comments

Johnny vd Laar’s picture

Issue was found in this issue:
https://drupal.org/node/1862758#comment-7261618
http://drupal.org/node/1848686#comment-7261878

A patch that fixes this and adds extra test coverage is added here:
http://drupal.org/node/1848686#comment-7261878

Johnny vd Laar’s picture

Priority: Normal » Major

I guess this should be a major issue because now the permissions don't work properly?

berdir’s picture

As that other issue is a feature request, which are blocked by thresholds, it's basically blocking itself with this issue :)

You should extract the fix and a test for it and provide a patch here so that we can get it asap. Maybe the permission check should be updated and not hook_permission() ?

Johnny vd Laar’s picture

Node module also has "edit" so I guess it should be "edit" here as well. I'll add a patch here that also adds tests.

Johnny vd Laar’s picture

Status: Active » Needs review
StatusFileSize
new6.28 KB

Added is a patch that should fix the permission check and that adds the proper tests.

berdir’s picture

+++ b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyPermissionsTest.phpundefined
@@ -0,0 +1,135 @@
+ * Definition of Drupal\taxonomy\Tests\VocabularyPermissionsTest.

Should be Contains \Drupal\... now according to the current coding standards (there are a lot of old classes that don't follow this yet)

+++ b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyPermissionsTest.phpundefined
@@ -0,0 +1,135 @@
+    // Reset to get proper permissions.
+    drupal_static_reset();

You can use checkPermissions(array(), TRUE) to avoid resetting the complete static cache.

+++ b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyPermissionsTest.phpundefined
@@ -0,0 +1,135 @@
+    // Test as user with "update" permissions.
+    $user = $this->drupalCreateUser(array("edit terms in {$vocabulary->id()}"));

Comment is outdated now :)

Tests look nice otherwise, and thorough. Can you also upload a patch that only contains the tests so that we can see that it does fail and covers the bug.

Johnny vd Laar’s picture

Sorry can you explain what this means:
Should be Contains \Drupal\... now according to the current coding standards (there are a lot of old classes that don't follow this yet)

Attached is the test that should fail

berdir’s picture

In the @file docblock, write "Contains \Drupal\Core\..." instead of "Definition of Drupal\Core"... that's all :)

Status: Needs review » Needs work

The last submitted patch, drupal-edit-terms-permission-1966614-7.patch, failed testing.

Johnny vd Laar’s picture

Ok here is the modified patch with 2 changed comments.

Johnny vd Laar’s picture

Status: Needs work » Needs review
berdir’s picture

Status: Needs review » Needs work
+++ b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyPermissionsTest.phpundefined
@@ -0,0 +1,135 @@
+
+    // Reset to get proper permissions.
+    drupal_static_reset();

See above, this should call checkPermissions() so that it only resets the permission static cache.

Otherwise, this looks good. Please also upload an interdiff so that it's visible what changed between two patches.

jibran’s picture

Status: Needs work » Needs review
StatusFileSize
new825 bytes
new6.31 KB
new5.45 KB

Updated as per #12

Status: Needs review » Needs work

The last submitted patch, 1966614-13.patch, failed testing.

berdir’s picture

$this->checkPermissions(), it's a method, not a function :)

jibran’s picture

StatusFileSize
new735 bytes
new5.45 KB
new6.32 KB

Thanks @Berdir for pointing that out. I should have run the test locally first. It is passing on local now.

jibran’s picture

Status: Needs work » Needs review

Sending for test.

Status: Needs review » Needs work

The last submitted patch, 1966614-16-test-only-patch.patch, failed testing.

berdir’s picture

Status: Needs work » Reviewed & tested by the community

Fixes a bug and comes with good test coverage. Looks good to me :)

Edit: it was set to needs work because of the test-only patch. If you upload the test-only patch first, then, in most cases, the issue will stay at needs review because only the last-returned patch in an issue changes the status.

webchick’s picture

Status: Reviewed & tested by the community » Fixed

Wow. Good catch, AND that's awesome to have so many tests to make sure that it never, ever happens again! :D

Committed and pushed to 8.x. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.