For some reason, when I enter the URL /forum/x (relative to my webserver root) where x is a valid taxonomy term id (tid), Drupal displays the category that corresponds with the specified term id, as a forum. I have no idea why this happens, and I believe it to be a bug in Drupal core so I've submitted it here: http://drupal.org/node/74334.

This is an example of a category being displayed as a forum on the Drupal web site:

http://drupal.org/forum/41

More importantly than that, however, is the fact that when I've configured Taxonomy Access Control to hide category 123 for example, from being listed or viewed by anonymous users, they are still displayed to anonymous users at http://my.domain.com/forum/123 even though they're hidden in all other listings.

I am using the Taxonomy Access Control cvs version, dated July 18, 2006.

Comments

keve’s picture

keve commented

Does it displays correct on term_page:
/taxonomy/term/˙{term_id}?

It it is so, there might be a problem with forum.module when it calls hook_db_rewrite_sql.

klance’s picture

klance commented

It displays the category page instead of a forum page when I go to /taxonomy/term/{term_id} but, as with the /forum/{term_id} scenario, the forum, which is supposed to deny view, update, delete, create and list from all but one group, is again displaying its title to everyone, which is bad from the point of view that restricted content should be *completely* invisible to unauthorized users.

keve’s picture

keve commented

On my system, this works perfectly.

Please, check:
-Does it work with 4.7 version of TAC. (This "stable" version works without problem, i have been useing it on my commercial site)
-If it does not work, then re-check that your category permissions are set correctly. (especially list property)

Displaying /taxonomy/term/{tid} is controlled by 'list' property.

klance’s picture

klance commented

On my production site I use TAC 4.7 with Drupal 4.7.2.

Do you have an example of both a forum and a category on your commercial site, that have both LIST and VIEW disabled for anonymous users?

If so, can you (logged off) get Drupal to display the title of the forum via /forum/{forum id}?

Then, can you (logged off) get Drupal to display the forum as a category by replacing /forum/{forum id} with /taxonomy/term/{forum id}?

Then, can you (logged off) get Drupal to display the category as a forum by replacing /taxonomy/term/{term id} with /forum/{term id}?

keve’s picture

keve commented

>If so, can you (logged off) get Drupal to display the title of the forum via /forum/{forum id}?
Yes, it is displayed

>Then, can you (logged off) get Drupal to display the forum as a category by replacing /forum/{forum id}
>with /taxonomy/term/{forum id}?
No, it is hidden. (As it should be).

>Then, can you (logged off) get Drupal to display the category as a forum by replacing
>/taxonomy/term/{term id} with /forum/{term id}?
It is displayed.

I guess there is a problem somewhere in forum.module when it calls db_rewrite_sql. (Or maybe it does not call db_rewrite_sql).
I will check it later.

klance’s picture

klance commented

Okay, good, so we're experiencing the same behavior. Thanks very much for taking the time to look into this, keve. As I said in my original post, I've submitted this as a bug in Drupal forum.module at http://drupal.org/node/74334.

klance’s picture

klance commented

I figured out part of the problem. I had "forums" checked in the allowed "Types" for my main content vocabulary. There is a second vocabulary called "Forums" that I assume was created automatically, because I didn't create it. In the "Forums" vocabulary, only "forum topic" is selected, and cannot be de-selected. When I unchecked "forums" in my main content vocabulary, I was no longer able to view forums as taxonomy terms using /taxonomy/term/{forum id}, so that solved part of my problem.

Now my only outstanding issue is the fact that the titles of my forums are visible to anonymous users when VIEW and LIST are disabled, instead of getting a "page not found" error like I do when I view a taxonomy term that has VIEW and LIST disabled.

keve’s picture

keve commented

Yes, as i stated this is a security bug in forum.module.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Project: Taxonomy Access Control » Drupal core
Version: master » 6.x-dev
Component: Code » forum.module

Moving project/component since this is in forum.module.

The desired behavior is for forum.module not to display the page title if they do not have access to the category and instead to display an "access denied".

RobRoy’s picture

RobRoy commented
Version: 6.x-dev » 5.x-dev

Since this is a valid bug, should be 5.x-dev no?

liam mcdermott’s picture

liam mcdermott commented
Status: Active » Fixed

Tested in 5.7 and am correctly given an 'Access denied' message, not the forum title.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.