Currently, the create op is controlled solely in hook_db_rewrite_sql(). This has advantages and disadvantages. Another method would be to use hook_nodeapi() and hook_form_alter().

This would resolve:
#112307: Cannot create node in taxonomy term without create permission for parent term

and avoid problems like:
#881210: No list or create permissions on any terms may result in incorrect use of default on save
#660668: TAC + revisioning: Empty taxonomy term select list on node/add for regular users

There are a couple of disadvantages. One is that FAPI's #access option can only apply to whole form elements, so if the user has access to create some terms in a vocabulary but not others, we still have to override the whole form element. Another is that any form overrides we provide will by default support only the core taxonomy forms, not other modules that alter those forms (like Content Taxonomy).

For these reason, we might want to make this behavior configurable, and possibly release it only in a new branch since it involves major changes to the way create functions.

Original patch is at:
http://drupal.org/files/issues/tac_881210-9.patch

CommentFileSizeAuthor
#1 tac_903522.patch16.88 KBxjm
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

xjm’s picture

FileSize
16.88 KB

Also, a hook_update_N() would need to be provided because of #112307: Cannot create node in taxonomy term without create permission for parent term, to prevent an unexpected change in behavior for anyone
who for whatever reason has create checked for a parent term but not its children.

Same patch as above, just renamed for consistency. It applies with an offset currently.

xjm’s picture

See also #308682: Cooperation with Clone/Revisioning/... module. We need to address that case somehow as well.

xjm’s picture

xjm’s picture