Closed (won't fix)
Project:
Drupal core
Version:
4.6.2
Component:
tracker.module
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
19 Aug 2005 at 23:08 UTC
Updated:
16 Oct 2005 at 17:29 UTC
The tracker.module does not appear to filter content according to taxonomy_access or node_access_byrole permissions, whether they are enabled at the same time or independently. I covered the problem fairly well in http://drupal.org/node/28653.
The recent posts page shows all content from the site, allowing users to see every post, whether they have access to it or not. This allows a user to gain "back door" access to certain taxonomies that should otherwise be restricted. This is one of the few modules that does not make use of the taxonomy_access permissions.
Comments
Comment #1
killes@www.drop.org commentedthat is probably a bug in the referenced module. Didin't find a bug in tracker.module.