When user has no access permission to a term, the page returned by the system is always "Page Not Found" after the activation of the module "Taxonomy Access Control". However, the term is definitely existing but just because the user has no permission to it.

CommentFileSizeAuthor
#5 taxonomy-page-not-found-311649.patch682 bytesWorldFallz

Comments

wangmz’s picture

wangmz commented
Status: Active » Needs review

The reason for the bug is that taxonomy.module accept the term set from "Taxonomy Access Control" as the existing terms, but not compare with the database. The solution is to have a double check against the database, thus can identify the terms that are not existing and that are not permitted.

The modification is to change the default return of the function taxonomy_term_page() in modules/taxonomy/taxonomy.pages.inc:

if ($names) {
... ...
}
else {
/* content added to test if the term exist but filtered by taxonomy access control module */
foreach ($terms['tids'] as $termId) {
if (isset(taxonomy_get_term($termId)->name)) {
drupal_access_denied();
return;
}
}
/* end the modification */

drupal_not_found();
}

I hope this information is useful and someone can make a patch to the repository after checking my codes. Thank you.

Anonymous’s picture

Anonymous (not verified) commented
Status: Needs review » Postponed (maintainer needs more info)

This is not a patch. See http://drupal.org/patch/create for details of how to create a patch.

catch’s picture

catch
he/him
Primary language English
commented
Version: 6.3 » 7.x-dev
Status: Postponed (maintainer needs more info) » Active

It's not a patch, but it's still a bug, so should be set to active.

WorldFallz’s picture

WorldFallz commented
Status: Active » Needs review
StatusFileSize
new taxonomy-page-not-found-311649.patch682 bytes

Bug Bingo!

Proper patch attached.

Status: Needs review » Needs work

The last submitted patch failed testing.

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Project: Drupal core » Taxonomy Access Control
Version: 7.x-dev » master
Component: taxonomy.module » Code

IMO this is not a core bug: users with "access content" permissions can visit the term page, users without permission get an "access denied". If taxonomy access control changes the behavior, it's probably best placed to handle this (maybe change the access callback through hook_menu_alter?)

xjm’s picture

xjm
she/her
Primary language English
commented

Marked #688664: Inconsistent Messages When Viewing Inaccessible Content as duplicate of this.

xjm’s picture

xjm
she/her
Primary language English
commented
Version: master » 6.x-1.x-dev

Marked #323790: Page Not Found as duplicate of this issue. We should try to find a fix for this in D6 first, then backport to D5 if possible/time permitting.

xjm’s picture

xjm
she/her
Primary language English
commented

Marked #181461: Denied users to be redirected to Register /login page as duplicate.

gusanocomemuerto’s picture

gusanocomemuerto commented

So what is the workaround? We are restricting access to different kinds of content through taxonomy access control lite. Our customers are going to pay for access to different taxonomy channels, and if they haven't paid for access to a given channel, I need to prompt them to subscribe, not tell them the content doesn't exist. I can do this using the error reporting control, but this means that we won't be able to tell genuine page not found errors from information that is unavailable due to their user role. So if there is a genuine 404 problem, we don't want to tell them it's because they didn't subscribe.

xjm’s picture

xjm
she/her
Primary language English
commented

There are two possibilities for workarounds that I can see until this is fixed in TAC:

  1. Try the patch to the core taxonomy module in #5 above, or
  2. Try using an additional module in the interim to manually restrict the term pages for roles that you know a role should not see, for example, the path access module. (I don't recommend this as a longterm solution, but it could help in the meanwhile.

I have used #2 in the past, but it is not the best solution. I'd test the patch first (thoroughly and on a non-production site).

If you are having this problem in TAC lite, I recommend submitting an issue to that issue queue as well:
http://drupal.org/project/issues/tac_lite

xjm’s picture

xjm
she/her
Primary language English
commented

Marked #573674: Deny access to term page? as duplicate of this issue.

xjm’s picture

xjm
she/her
Primary language English
commented

See #679308: inaccessible nodes still listed in menus? (drupal 6).

xjm’s picture

xjm
she/her
Primary language English
commented

Marked #1218106: Prompt for login at taxonomy term as duplicate.

neilb2’s picture

neilb2 commented

I am experiencing this problem on a site. Could someone please confirm that the problem is being caused by the issue being discussed in this thread?

Latest versions of Drupal 6, TAC and Taxonomy Access Control installed.

When taxonomy/term/% view is switched OFF in Views (and hardcoded term page is used):

  • The Taxonony Menu correctly hides any vocabularies and terms that the user does not have access to
  • But nodes on a term page display in a strange order and are not configurable through the UI

When taxonomy/term/% view is switched ON in Views:

  • The Taxonony Menu shows every vocabulary and term on the whole site
  • If a user tries visiting a term page he/she doesn't have access to, they get the title of the term but no nodes listed (i.e. a blank page, but not Page Not Found or Access Denied)
  • But, the display of a term index page is fully configurable through Views

Is this the current behaviour of this combination of modules/views?

My desired outcome would be where the taxonomy/term/% view is switched on in Views, but with the Taxonomy Menu correctly displaying only the vocabs/terms the user has access to and any non-accessile term pages 404ing (or 403ing).

Any help much appreciated.