Permission By Term access not respected

Created on 1 July 2021, about 3 years ago
Updated 3 June 2024, 29 days ago

Problem/Motivation

I am using Search API(8.x-1.19) β†’ in Drupal 8.9.16 along with the Permission By Term - PBT - module (8.x-2.33) β†’ which does a great job of making certain nodes with certain terms accessible only to certain roles.

BUT, the Content Access restrictions applied by the PBT module don't seem to be respected by Search API even when the Content access processor is active.

I have read that "...it's not always possible to respect..." third party module access grants but given the power and popularity of the PBT module this seems a bit of an oversight.

Has anyone else had the same trouble?

To clarify, my problem is that my Search API-powered view page is displaying the teaser of a node to the anonymous user when they clearly should not have access to that node by virtue of a Tax term applied to it. Clicking through from the teaser, it is clear as day that they can't really access it.

I have no Views overrides on content access checks in play within the view either.

Thanks

πŸ› Bug report
Status

Postponed: needs info

Version

1.19

Component

General code

Created by

πŸ‡¬πŸ‡§United Kingdom SirClickALot Somerset

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • I had the same issue. You have to create a preprocessor or tweak the content_access one. If i'm understanding this correctly : Search Api takes all the grants and if one is ok then the page is shown. I've resolved this by changing the addFieldValues function in contentAccess.php. Now, it first check if there is a grant in the permissions_by_term realm. If so it only take those grants. If not it works as normal.

Production build 0.69.0 2024