Problem/Motivation

In #1848686: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission) (Change record), a new permission "Access the taxonomy vocabulary overview page" was added.

A permission per vocabulary was left for a followup issue. Here is that issue.

In @berdir's overview comment #1848686-179: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission), he stated:

For the access, we have 4 different options I think:
A) A single permission like proposed here
B) A single permission, checked with e.g. $vocabulary->access('access term overview'), allows custom/contrib code to easily check access.
C) A permission per vocabulary
D) A permission per vocabulary, checked with e.g. $vocabulary->access('access term overview'), allows custom/contrib code to easily check access.

I think I would suggest B or D. I'll try to implement B here to see how that looks. From there, going to D would be fairly simple.

Proposed resolution

Code it.

Remaining tasks

Code, review, commit.

User interface changes

New permissions "access vocabulary FOO overview"

API changes

None.

Data model changes

None.

Release notes snippet

TBD

Comments

axel.rutz created an issue. See original summary.

geek-merlin’s picture

Title: Add "access vocabulary overview" permission » Add "access vocabulary FOO overview" permission
Issue summary: View changes
berdir’s picture

IIRC, B was implemented so that a custom/contrib module could easily provide the extra permission. I'm not sure that the use case for that is common enough to be in core. Every permission that is added makes the permission page a bit bigger again...

andypost’s picture

Issue tags: +Needs tests

Not clear the reason to "access" overview - the reason to access overview is only to reorder terms (except lookup) then it fits into mapping to vocabulary form access

geek-merlin’s picture

I'm currently facing such a use case, which is simply:
* Have lots of vocabs
* Want to grant some role the permission to administer (say) only one vocab

With current permissions, a user that can see the vocab overview page, can browse and see all vocab admin pages (but not edit terms).
This is just confusing and core should allow fixing this without custom code.

#4: If we can deny access to vocab admin pages without additional permission (no add / edit / reorder permission, no access), all the better.

berdir’s picture

> #4: If we can deny access to vocab admin pages without additional permission (no add / edit / reorder permission, no access), all the better.

Being able to just view a list of all terms without any access to change them is a valid use case, e.g. to have a list of things to look at or so. It's also impossible to check anyway, entity access would allow to only grant edit access for specific terms, based on arbitrary conditions. We can't check that for the whole list.

> I'm currently facing such a use case, which is simply:

Yes, but the question is whether your use case is common enough to warrant having those permissions around for everyone :)

Using the hook, if you do want to limit it based on the edit permission for example, you could implement hook_taxonomy_vocabulary_access(), look for $operation 'access term overview' and return forbidden if the user doesn't have administer taxonomy or the edit permission. That's just a handful lines of code and doesn't need any new permissions. But it's not an assumption that works for everyone.

geek-merlin’s picture

Let's investigate the demand. According to your list, we have in #1038330: Allow specific vocabulary permissions to work on vocabulary admin pages from 2011, 39 followers. Which may or may not tell us much.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

teknocat’s picture

I believe this is sufficiently handled by the Taxonomy Access Fix module.

This provides "view" and "reorder" permissions for each vocabulary. I frequently find this useful in sites we create because we often have a vocabulary or two that only developers, not content admins, should modify, so we want to limit which ones the admins or other roles can see. Also, we sometimes have the use case where the client wants a user role that can only edit certain content, including specific vocabularies. They all need to have access to the vocabulary overview page, otherwise, nothing appears for them to access it via the admin toolbar, but as others have noted here, seeing all the other vocabularies they cannot do anything with is just confusing. Plus, it may show them ones they don't need to know even exist because we are perhaps using them for some kind of functionality that only developers should ever have access to see and modify.

While I kind of wish this was in core without the need for an extra module, I think I agree that this is not necessarily a common use case. And many of our sites don't have vocabularies that the content admins shouldn't be able to modify, so even we don't use it all the time. So it would indeed just add more permissions to the permissions page that may not be needed most of the time.

There's also the Vocabulary Permissions Per Role module if you want to allow certain roles to fully administer only certain vocabularies. So between these 2 contrib modules, you can get whatever you need for taxonomy permissions.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.