Problem/Motivation
I have a Vocabulary 'Resort' that use permissions_by_term to restrict access.
When I create a New node in english (default language) with taxonomy 'Resort' field I only have access to the Resort I should have access.
But when I try to create it from another language url like this one: /fr/node/add/activity_card I have access to all the Resorts for this field.
I have 2 languages installed 'en' & 'fr'. 'en' being the default one.
The restriction is done by user and by role.
The user I use do not have the allowed role but is listed as a valid user for 1 term and 1 term only.
In the end The user can create the Node for another Resort but he cannot access it once created.
So:
/node/add/activity_card is OK
/fr/node/add/activity_card is KO
I tried to rebuild permissions (/admin/reports/status/rebuild), it doesn't solve the issue.
| Comment | File | Size | Author |
|---|---|---|---|
| #18 | 2982955-saving-term-with-multiple-langcodes-2.patch | 15.74 KB | gpz |
| #13 | 2982955-saving-term-with-multiple-langcodes.patch | 14.16 KB | jepster_ |
| #11 | 2982955-removed-tid-as-primary-key.patch | 453 bytes | jepster_ |
| #5 | db.jpg | 142.06 KB | gpz |
| #5 | node_edit_fr.jpg | 63.32 KB | gpz |
Comments
Comment #2
jepster_Are you using the Content Translation module for translating your nodes? Do the nodes have different node ids? Does each node id have different taxonomy terms?
Comment #3
jepster_Are your terms in the same language as the nodes? Please make sure, that your node is in the same language as your related taxonomy term. Otherwise the permission handling does not apply.
Comment #4
jepster_Content language must match the term language. This is a feature and not a bug.
Comment #5
gpz commentedThank you for your reply and sorry for my late reply.
- Yes I use the Content Translation module.
- I use the translation tab to translate a node.
- Nodes have the same Id across languages but I was talking about the node/ADD, so the node id is not revealant here. But I have the same issue with the edit.
- Terms are translated the same way (I have 4 of them, all of them are translated, and the user used for the screenshot should only have access to one of them 'Marrakech')
- The field on the node with the taxonomy reference was not a translatable field (I don't want that the english point to a term and another language to another term). But I've tried to make this field translatable and it doesn't change the issue.
I have uploaded some images to show what I have in English and what I have in French and an extract of the DB.
I might do something wrong but I don't know what.
Comment #6
gpz commentedIt seems to work now with the 1.58 version
Comment #7
jepster_Perhaps your issue was related to #2911842: Restricted node appears in view.
Comment #8
gpz commentedWell, I was too quick to shout victory.
I might be doing something wrong.
I created an example here to reproduce the problem: https://dfz3x.ply.st
Admin
username: admin
password: admin
User with problem
username: USER2
password: USER2
When editing with USER2 this following node, we can see in the select every terms:
https://dfz3x.ply.st/fr/node/7/edit
The english one is OK:
https://dfz3x.ply.st/node/7/edit
I have rendered the taxo field as a rendered entity to show that languages match:
https://dfz3x.ply.st/node/7
https://dfz3x.ply.st/fr/node/7
Comment #9
gpz commentedI think that part of the problem is due to primary keys.
tid + uid is not enough.
I cannot add multiple languages for the same tid and uid in the table permissions_by_term_user (the problem will be the same with permissions_by_term_role)
I tried to also add langcode as primary key and manually insert a tid/uid/langcode and it seems to work (need more test). Unfortunately when you save a Term from the translated version, the table is not updated to add the a line with the langcode. If you change the user, it will then replace the line with the new user and the current langcode but we'll miss the one for the original langcode.
Comment #10
jepster_Yes, you cannot add multiple languages with the same tid. I have checked it right now. That's an issue. The db schema must be updated. Thanks for reporting!
Comment #11
jepster_@GPZ: Could you please check the attached patch for checking if it's solving the issue for you? I have removed the "tid" field in "permissions_by_term_role" and "permissions_by_term_user" as primary field in the DB schema.
Comment #12
gpz commentedThank you for the patch.
Unfortunately no, it doesn't solve the problem, it is even worst now.
I now cannot add the same role to multiple Term or a user to multiple Term.
I think it either need an unrelated unique primary key or add to primary keys the langcode.
But it won't be enough.
When adding a translation to a Term, and saving it, it doesn't save the new langcode in the permissions_by_term_user.
I think in AccessStorage::saveTermPermissions, getUserTermPermissionsByTid should use the langcode ? otherwise it find a result (but from the english version). It is probably the same for the getRoleTermPermissionsByTid.
Comment #13
jepster_@GPZ: Thanks for testing. I have modified the patch according to the mentioned methods. I have also written an automated test for that. The old Unit and Behat tests do run successfully: https://bitbucket.org/peter_majmesku/permissions_by_term/addon/pipelines....
Please test the updated patch (remove the changes from the old one and apply anew): https://www.drupal.org/files/issues/2018-08-11/2982955-saving-term-with-...
Comment #14
gpz commentedIt looks promising but I still have few problems. Thank you.
- I noticed that there is a missing argument in permissions_by_term_submit (.module) line 89. saveTermPermissions should take a langcode
- I also have warnings when adding a translation to a node (from english to french):
Comment #15
gpz commentedSorry, for the first problem, it's my bad, the warning was not a missing argument but an unhandle exception (permissions_by_term.mode line 89 - patch applied)
For the second problem I just added
$langcode = \Drupal::languageManager()->getCurrentLanguage()->getId();in functionsgetUserTermPermissionsByTidsandgetRoleTermPermissionsByTidsinAccessStorage.php. It's not perfect as you could edit the english translation from the french but I'm not sure how I can get the information from those functions.Otherwise it seems to work well. Thank you.
Comment #16
gpz commentedIs it normal it does "Rebuilding content access permissions" each time I add a user to "Allowed users" in the permission Details ?
Comment #18
gpz commentedI saw you did a new version with the patch. Great!
But you didn't changed the call to getUserTermPermissionsByTid inside getUserTermPermissionsByTids (same for Role).
I join the patch I applied myself to v1.58
I saw someone else did a patch to v1.59 by adding a default value to getRoleTermPermissionsByTid.
https://www.drupal.org/project/permissions_by_term/issues/2992782
Moreover I think you should warn other users in the Release note that your service API changed from 1.58 to 1.59.
I, for example use your service AccessStorage to filter the Content View and to add/Remove user to a term from the user form.
The following methods have a new parameter:
- getUserTermPermissionsByTid
- getRoleTermPermissionsByTid
- getAllowedUserIds
- deleteTermPermissionsByUserIds
- deleteTermPermissionsByRoleIds
even
- getSubmittedUserIds (I think the parameter is not used in this one)
Comment #19
jepster_The missing parameter is fixed at https://www.drupal.org/project/permissions_by_term/issues/2992782.
Comment #20
jepster_