All rights of the taxonomy manager depend on the 'administer taxonomy'.

It would be better to respect the core taxonomy permissions per vocabulary or set an own permission per vocabulary.

At least the basic permission should be changed to 'administer taxonomies by taxonomy manager' instead of 'administer taxonomy'.

Comments

demonde created an issue. See original summary.

astonvictor’s picture

You can try Taxonomy access fix module. It adds additional permissions.

demonde’s picture

This has no effect, since TM relies on only one permission and does not respect others.

jacobsanford’s picture

Status: Active » Needs work

Hi @demonde,

This is a much needed suggestion - with the new dynamic taxonomy permissions in 8.x, it only makes sense to respect them. Setting to 'needs work', and perhaps someone can get to work on a permissions callback instead of the single, flat permission.

demonde’s picture

Here is some overview to the changes in Drupal Core 8.5:

https://www.drupal.org/project/drupal/issues/1848686

attisan’s picture

Assigned: Unassigned » attisan
Status: Needs work » Needs review
StatusFileSize
new3.01 KB

adding vocabulary based permission checks

demonde’s picture

I can apply the patch but I donnot understand which permissions grant access to the taxonomy manager.

I can access

/admin/structure/taxonomy_manager/voc/my_vocabulary_with_granted_access

but I cannot access the taxonomy overview page even as admin 1.

/admin/structure/taxonomy_manager

markusd1984’s picture

Any chance to get this rolled back for D7 as well please?

carolpettirossi’s picture

Hi there,

I created a specific permission "access taxonomy manager list" in order to solve the issue reported by @demonde.
I also added checks on MainController::listVocabularies() to:
- display "Add new vocabulary" link only if user has "administer taxonomy" permission
- display "Edit vocabulary settings" only if user has "access taxonomy overview" permission

I hope the patch is useful to everyone and gets committed soon to a new release :)

Thanks,
Carol

lisa.rae’s picture

Applied patch from #10, set permissions for a role to add and edit terms but not delete, permissions schema does not appear to work -- users with the role that does not have delete permissions are allowed to delete terms through the Taxonomy Manager interface.

lisa.rae’s picture

Status: Needs review » Needs work
carolpettirossi’s picture

I've updated "/taxonomy_manager/subTree" route to use the new "access taxonomy manager list"permission.
Without this change, taxonomy with multi level terms fail to load children (Load error) when user clicks to show sub tree.

The issue reported above by @lhridley has not been fixed yet.

ivnish’s picture

Status: Needs work » Needs review
demonde’s picture

To me this works fine.

carolpettirossi’s picture

Hi community,

I'm adding a new patch re-rolled for 8.x.1.x version.

carolpettirossi’s picture

Here's a new patch in case anyone is using the D9 version of this module (2.x)

vladimiraus’s picture

Status: Needs review » Reviewed & tested by the community
vladimiraus’s picture

Assigned: attisan » Unassigned

vladimiraus’s picture

Status: Reviewed & tested by the community » Fixed

Thanks everyone for contributing, testing and reviewing!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.