The core tracker.module used to display recent post information about a given user or an entire site ( e.g. http://drupal.org/tracker ) ignores taxonomy_access permissions and lists all content, the user creating the content, and the time the content was created.

Taxonomy_access needs to either:

a) filter the tracker.module somehow

or

b) at the least, include a mention of this hole in the documentation.

This was already filed under tracker.module ( 'Filtering taxonomy access in tracker.module' ( http://drupal.org/node/29228 ) ) and has been set to (won't fix) determined a problem with this module and not the tracker.module.

See also:

Extended discussion without resolution 'please help, please help' ( http://drupal.org/node/28653 )

Yet another request, 'Use Tracker with "private" nodes' ( http://drupal.org/node/40616 )

old patch at Tracker.module permission handling ( http://drupal.org/node/31292 )

hack to hide from tracker.module from 2004 ( http://drupal.org/node/5909 )

There are more ... but that should get the layman started.

Comments

keve’s picture

keve commented

I cannot regenerate this bug. I tried on 4.7.2.
Do you use latest TAC (Latest for 4.7: $id: v.1,77)
/tracker page on my test site, hides nodes that user does not have permission. (I tried it for anoymous user)

catch’s picture

catch
he/him
Primary language English
commented

Hi we just opened our new forums up (converted from phpbb) and found out when one of our users helpfully posted in our security thread ;)

we're on 4.7.2 using taxonomy access, php5/mysql5

catch’s picture

catch
he/him
Primary language English
commented

ps - this version: // $Id: taxonomy_access.module,v 1.77 2006/04/14 12:59:05 keve Exp $

keve’s picture

keve commented

Where, on which page (or block) do you experience this exactly?
For me /tracker or /user/x/track works fine. It hides nodes that user do not have access.
Please, describe me how to reproduce this.

catch’s picture

catch
he/him
Primary language English
commented

/tracker was displaying everything posted.

/user/x/track - I didn't check that, have disabled tracker.module for now and loathe to reactivate it since our regular users are now trying it out. However I'm going to copy my existing forum over to a development site later on today to test this further. I'm wondering if it's the same thing as the uncategorised content issue.

keve’s picture

keve commented

I just fixed uncategorized issue. Please, update the module and run update.php.
Please, deactivate and re-activate TAC on settings page after Update.

/tracker for me hides content correctly.

catch’s picture

catch
he/him
Primary language English
commented

update.php produced errors - said nothing to update.

But after disabling, deactivating, reactivating etc. tracker is hiding new posts.

fwiw, no view access away from anon/auth users was fixing the tracker issue, so for me at least exactly the same issue.

Thanks for this, much appreciate you sorting this out and you couldn't have fixed it any quicker - less than two hours!!

keve’s picture

keve commented

Update error: You could not choose #3 (update #3 of TAC)?
It takes time to get into tarball (max. 24.h) . Try to download the .install file (version 1.5) from repository. http://cvs.drupal.org/viewcvs/drupal/contributions/modules/taxonomy_access/

If you use CVS: I also have to refresh 'update.php' to HEAD.

keve’s picture

keve commented

I guess this is also solved with 'uncategorized' issue.
http://drupal.org/node/72663

The problem was:
In 'nodeapi' it saved the new node without 'categories' as uncategorized.

Please, let me know if this trouble w/ tracker persist.

catch’s picture

catch
he/him
Primary language English
commented

there was no update 3 at all.

I'll try downloading the files individually from that link and running it again.

catch’s picture

catch
he/him
Primary language English
commented

yes the .install file from cvs had an update 3 - I think it's fine now.

Thanks again!

catch’s picture

catch
he/him
Primary language English
commented

I don't think this is necessarily a problem with taxonomy access, but I've noticed that comment rss bypasses it as well in a similar way to the tracker. If I enable comment rss, the /crss links shows every post made regardless of taxonomy access permissions.

/tracker appears to be working 100% fine now.

catch’s picture

catch
he/him
Primary language English
commented
Status: Active » Closed (fixed)

Closing this since it was fixed almost two years ago.