Synopsis

Taxonomy Access Fix grants permission for users to create terms based on a per-vocabulary add terms in permission. Drupal Core does the same based on a per-vocabulary create terms in permission, which is not used when Taxonomy Access Fix is installed. This is confusing for site builders and requires to re-implement a lot of the checks already done by core just to use another permission name. Taxonomy Access Fix should migrate users to Drupal Core's permission instead.

Discussion

As part of this issue, we should

  1. remove the checkCreateAccess() method from the access control handler so that the parent implementation provided by Drupal Core is used. Note: This will grant users with permission to Administer vocabularies and terms access to create terms programmatically, which they didn't have in earlier versions. This should be okay without opening a new branch, since the permission is the ultimate administrative permission used by Taxonomy module that should in theory grant access to everything Taxonomy no matter what. Also, affected users already have access to the route to create terms via UI, so this looks more like an oversight/bug. We will inform users of the module about this change in the release notes anyway.
  2. remove the route alteration of the entity.taxonomy_term.add_form. Drupal Core will check for the create terms in permission already.
  3. remove the getOperations() method from the vocabulary list builder. Drupal Core will check for the create terms in permission already.
  4. use the parent's currentUser property in the render() method of the vocabulary list builder instead of using \Drupal.
  5. add a description to the add terms in permission informing users about the migration to Drupal Core's permission.
  6. add dependency injection for the permission callback class.
  7. rename the permission callback from getAccess() to getPermissions(), so that the name better reflects what the method does.
  8. introduce an update path that grants the create terms in permission to roles that have permission to add terms in.
  9. only provide the add terms in permission when the user has not yet run the update path.
  10. update existing tests as needed.
  11. add tests for the update path.
  12. make any changes needed for compatibility with Drupal Coding Standards in files we touch anyway.

Release notes snippets

Users with permission to Administer vocabularies and terms now have permission to create Taxonomy terms programmatically in any vocabulary without the need for any other permission. Previously, they only had access to create terms in any vocabulary via UI, but not programmatically.

Please note: There are database changes in this release. Users upgrading from 8.x-2.7 or earlier releases must apply database updates (e.g. run update.php) for the changes to take effect.

The Add terms in vocabulary permissions provided by Taxonomy Access Fix are no longer used and will be removed in a future release. Roles with this permission will be assigned the Vocabulary: Create terms permissions provided by Drupal Core during the update. Users are encouraged to review the updated permissions.

Comments

FeyP created an issue. See original summary.

feyp’s picture

Assigned: feyp » Unassigned
Status: Active » Needs review
StatusFileSize
new42.33 KB
new35.29 KB

Attached is a patch against 8.x-2.x. Note that the patch file includes the changes from #3100469-2: Extend TermAccessControlHander instead of EntityAccessControlHandler to facilitate automated testing. I provided an interdiff file that contains only the changes I think should be made in this issue.

casey’s picture

StatusFileSize
new40.98 KB

Reroll of the patch without the update hook; for those who want to use the patch right now without screwing up their module update status :)

FeyP credited Anybody.

FeyP credited voleger.

feyp’s picture

Crediting voleger and Anybody for reviewing and testing the original patch in the private issue on security.drupal.org.

  • FeyP committed d6c8d32 on 8.x-2.x
    Issue #3100474 by FeyP, voleger, Anybody: Migrate from 'Add terms in...
feyp’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.