Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.In taxonomy module, users need the 'access content' permission for access to taxonomy/term/x and indeed anything to do with taxonomy, and hence a user without this permission can't discover the names of any terms.
So technically, we shouldn't show *any* taxonomy form to a user without that permission.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 784248.user_terms.check-access_content-perm.patch | 1.1 KB | joachim |
| #1 | user_terms.patch | 648 bytes | yeputons |
Comments
Comment #1
yeputons commentedI think that it's easy. But we cannot do anything with views fields, can we? User terms uses standard views handlers, which haven't any access checking.
Comment #2
yeputons commentedComment #3
joachim commentedYup, it's a simple patch, but I posted this also to see what people think of the change :)
Going to leave it open a while longer.
Comment #4
joachim commentedProbably better done with FormAPI's #access property. That way, if there are other modules that want to provide more subtle access such as to a single vocabulary, they can still find the form and change it. Though granted, having users who have accounts but can't see content is probably a rare case...
#784248 by joachim, yeputons: Fixed terms shown to users without 'access content' permission.