A user needs 'administer taxonomy' permission to use this module, which when they do a Bulk Delete Terms button appears at the bottom of the Taxonomy's page to click on.
When a user does not have this permission, the button still appears... it should not appear.
However, after clicking on the button, the user is indeed denied access to the form. That much is good.
But an access check should also be done as to whether or not to show the button itself.
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes, plain diff MR !2
Comments
Comment #3
fizcs3 commentedMR!2 above with fix.
Open to further review.
Comment #4
fizcs3 commentedI am realizing that my above MR!2, with slight tweaks, was actually incorporated in the merge request of another issue, and released in version of 1.0.4.
I did a quick check and version 1.0.4 does fix this issue.