Problem/Motivation
In #1848686: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission) (Change record), a new permission "Access the taxonomy vocabulary overview page" was added.
A permission per vocabulary was left for a followup issue. Here is that issue.
In @berdir's overview comment #1848686-179: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission), he stated:
For the access, we have 4 different options I think:
A) A single permission like proposed here
B) A single permission, checked with e.g. $vocabulary->access('access term overview'), allows custom/contrib code to easily check access.
C) A permission per vocabulary
D) A permission per vocabulary, checked with e.g. $vocabulary->access('access term overview'), allows custom/contrib code to easily check access.I think I would suggest B or D. I'll try to implement B here to see how that looks. From there, going to D would be fairly simple.
Proposed resolution
Code it.
Remaining tasks
Code, review, commit.
User interface changes
New permissions "access vocabulary FOO overview"
API changes
None.
Data model changes
None.
Release notes snippet
TBD
Comments
Comment #2
geek-merlinComment #3
berdirIIRC, B was implemented so that a custom/contrib module could easily provide the extra permission. I'm not sure that the use case for that is common enough to be in core. Every permission that is added makes the permission page a bit bigger again...
Comment #4
andypostNot clear the reason to "access" overview - the reason to access overview is only to reorder terms (except lookup) then it fits into mapping to vocabulary form access
Comment #5
geek-merlinI'm currently facing such a use case, which is simply:
* Have lots of vocabs
* Want to grant some role the permission to administer (say) only one vocab
With current permissions, a user that can see the vocab overview page, can browse and see all vocab admin pages (but not edit terms).
This is just confusing and core should allow fixing this without custom code.
#4: If we can deny access to vocab admin pages without additional permission (no add / edit / reorder permission, no access), all the better.
Comment #6
berdir> #4: If we can deny access to vocab admin pages without additional permission (no add / edit / reorder permission, no access), all the better.
Being able to just view a list of all terms without any access to change them is a valid use case, e.g. to have a list of things to look at or so. It's also impossible to check anyway, entity access would allow to only grant edit access for specific terms, based on arbitrary conditions. We can't check that for the whole list.
> I'm currently facing such a use case, which is simply:
Yes, but the question is whether your use case is common enough to warrant having those permissions around for everyone :)
Using the hook, if you do want to limit it based on the edit permission for example, you could implement hook_taxonomy_vocabulary_access(), look for $operation 'access term overview' and return forbidden if the user doesn't have administer taxonomy or the edit permission. That's just a handful lines of code and doesn't need any new permissions. But it's not an assumption that works for everyone.
Comment #7
geek-merlinLet's investigate the demand. According to your list, we have in #1038330: Allow specific vocabulary permissions to work on vocabulary admin pages from 2011, 39 followers. Which may or may not tell us much.
Comment #15
teknocat commentedI believe this is sufficiently handled by the Taxonomy Access Fix module.
This provides "view" and "reorder" permissions for each vocabulary. I frequently find this useful in sites we create because we often have a vocabulary or two that only developers, not content admins, should modify, so we want to limit which ones the admins or other roles can see. Also, we sometimes have the use case where the client wants a user role that can only edit certain content, including specific vocabularies. They all need to have access to the vocabulary overview page, otherwise, nothing appears for them to access it via the admin toolbar, but as others have noted here, seeing all the other vocabularies they cannot do anything with is just confusing. Plus, it may show them ones they don't need to know even exist because we are perhaps using them for some kind of functionality that only developers should ever have access to see and modify.
While I kind of wish this was in core without the need for an extra module, I think I agree that this is not necessarily a common use case. And many of our sites don't have vocabularies that the content admins shouldn't be able to modify, so even we don't use it all the time. So it would indeed just add more permissions to the permissions page that may not be needed most of the time.
There's also the Vocabulary Permissions Per Role module if you want to allow certain roles to fully administer only certain vocabularies. So between these 2 contrib modules, you can get whatever you need for taxonomy permissions.