If a user does not have access to a term page (eg /taxonomy/term/9) "Page not found" is displayed rather than "access denied".

Comments

Dave Cohen’s picture

Dave Cohen commented
Status: Active » Closed (works as designed)

This is the way Drupal's node access modules work. They change database queries such that content is not returned when the user cannot see it. So if node 100 were tagged with term 9, you'd see "page not found" for node/100 as well. This is how drupal core does it, so tac_lite does the same thing with term/9.

I don't see it as a problem, and if it were then the fix would require changes to drupal core in addition to access control modules. Think of it from a security perspective, if term/9 returned access denied, but term/10 returned page not found, a user would have a clue that there was in fact a term 9 which they could not see. The way things are, the user cannot even learn that much.