21 May 2007
01 Feb 2012
Link to this post
I'm trying to restrict a certain role from managing categories. For this role I deny all classification permissions. However, because they are also authors I allow them to create news and event items. The problem is when they go to create a news/event there is an option to assign and ADD a category. The news module does not respect the permission settings for classification and they are allowed to add one. Now, in their dashboard they don't have access to the categories module so in that sense the permissions are working. However, this loophole makes the permissions ineffective.
I presume this due to the fact that the permissions are per module so the news module doesn't care what permissions are set for the categories module.
Are there plans to change this behavior? Either add a subsection in news items permissions for categories or have the module reference the taxonomy permissions? Are there any simple workarounds in the meantime to remove the "add category" link programmatically?