With Taxonomy Permissions installed, unpublished terms become accessible to unauthenticated users.
Unpublish a taxonomy term and visit the term's canonical URL in an anonymous browser window. Should return the 403 page, but returns the term page instead (status code 200).
Respect the published state same as in a Drupal standard profile install.
Fix the access rules.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | 3465902-3.patch | 2.97 KB | norman.lol |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
norman.lolComment #3
norman.lolComment #5
norman.lolComment #6
norman.lolDamn, merging this was premature. I now understand that viewing unpublished terms is part of the business logic of this module. I'll revert the commit.
Comment #7
norman.lolAh, I never merged it. Good.
Comment #8
norman.lolOkay, let's do this differently then. Let's add another permission "view unpublished terms in [vocabulary]" for every vocabulary.Comment #10
norman.lolOkay, so in D7 taxonomy terms didn't have a status. That's why this was never part of the D7 version of taxonomy permissions. But D8+ comes with a status for terms and by default from core you have no access to them when they are unpublished. To avoid surprises as stated on the module's description page we should follow this pattern for now. And merge the prior MR as is. And if anybody requires it, we can add the view unpublished permissions. I think this is the way to go.
Comment #11
norman.lol