I have a Drupal installation which is intended only for authenticated users, so I have every box on the permissions screen unchecked under the "anonymous user" column. However, nodes are still visible to unauthenticated users simply by referencing the taxonomy summary page for each tid:

http://mydomain.com/taxonomy/page/or/TID

Where TID is any one of "select tid from term_data"

Seems to me there should be a "access taxonomy" permission defined.

CommentFileSizeAuthor
#2 taxonomy.access-bugfix.patch647 bytesYog

Comments

TDobes’s picture

TDobes commented

This has been fixed in Drupal 4.4, which is being prepared for release; development of the 4.3 branch has nearly stopped. Therefore, I'm setting this to won't fix... feel free to reopen if you have a patch.

Yog’s picture

Yog commented
StatusFileSize
new taxonomy.access-bugfix.patch647 bytes

I'm quite surprised at the casual dismissal of this bug. This is an extremely serious issue for users who are relying on Drupal's security system to keep their personal or company-sensitive information privte. I've attached a simple patch which seems to do the trick, but I'm not sure that it covers all the bases. If updates to the 4.3 branch are no longer going to occur (which seems odd considering 4.4 is at least a month away and 4.3 will still be in significant use after that), then I would think it prudent to at least make some sort of announcement regarding the issue.

moshe weitzman’s picture

moshe weitzman commented

duplicate of http://drupal.org/node/view/2076

please keep conversation there.