Multiple different access levels can cause permissions (terms) to be removed when updating content.

Created on 8 October 2021, over 2 years ago
Updated 2 February 2024, 5 months ago

Problem/Motivation

We noticed during testing that some times when content authors update content, terms they don't have access to (But already existing on the entity) will be removed from the entity when they saved.

Steps to reproduce

  1. Setup two terms, GroupA and GroupB
  2. Setup two users, UserA and UserB
  3. Assign GroupA to UserA and GroupB to UserB
  4. Create a new node. Assign GroupA and GroupB to that node.
  5. Login as UserA and update the page you just created.
  6. Once it's saved, GroupB will now longer be assigned to the node

Proposed resolution

The root of the issue seems to be that the permissions_by_term_options_list_alter function is removing terms from the list that the user doesn't have access to. So when the content item is saved, the terms are lost. My proposed resolution is that in the existing validation function, we can compare the new terms to the ones currently associated to the entity. Then take any terms already associated to the entity that we don't have access to, and re-add them. That way nothing is lost on save and they can still remove terms they do have access to. That's what the attached patch does.

πŸ› Bug report
Status

Needs review

Version

2.34

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States jacobbell84

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024