From 639a8ec8fa05d6474c8adbd730c25e53f42407ac Mon Sep 17 00:00:00 2001
From: catch <catch@35733.no-reply.drupal.org>
Date: Mon, 31 Aug 2020 09:22:45 +0100
Subject: [PATCH] Issue #3101738 by Lendude, jannakha, alexpott, daffie,
bkosborne, Berdir: Exposed term filters should not show term options that the
user does not have access to
---
.../Plugin/views/filter/TaxonomyIndexTid.php | 4 +++
.../Views/TaxonomyIndexTidUiTest.php | 30 +++++++++++++++++++
2 files changed, 34 insertions(+)
diff --git a/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php b/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php
index 5829681767c7..7778153b96b4 100644
--- a/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php
+++ b/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php
@@ -181,6 +181,9 @@ protected function valueForm(&$form, FormStateInterface $form_state) {
if ($tree) {
foreach ($tree as $term) {
+ if (!$term->isPublished()) {
+ continue;
+ }
$choice = new \stdClass();
$choice->option = [$term->id() => str_repeat('-', $term->depth) . \Drupal::service('entity.repository')->getTranslationFromContext($term)->label()];
$options[] = $choice;
@@ -190,6 +193,7 @@ protected function valueForm(&$form, FormStateInterface $form_state) {
else {
$options = [];
$query = \Drupal::entityQuery('taxonomy_term')
+ ->condition('status', 1)
// @todo Sorting on vocabulary properties -
// https://www.drupal.org/node/1821274.
->sort('weight')
diff --git a/core/modules/taxonomy/tests/src/Functional/Views/TaxonomyIndexTidUiTest.php b/core/modules/taxonomy/tests/src/Functional/Views/TaxonomyIndexTidUiTest.php
index 3655369a29ba..054019628200 100644
--- a/core/modules/taxonomy/tests/src/Functional/Views/TaxonomyIndexTidUiTest.php
+++ b/core/modules/taxonomy/tests/src/Functional/Views/TaxonomyIndexTidUiTest.php
@@ -231,4 +231,34 @@ public function testExposedFilter() {
$this->assertTrue(empty($preview), 'No results.');
}
+ /**
+ * Tests that an exposed taxonomy filter doesn't show unpublished terms.
+ */
+ public function testExposedUnpublishedFilterOptions() {
+ $this->terms[1][0]->setUnpublished()->save();
+ // Expose the filter.
+ $this->drupalPostForm('admin/structure/views/nojs/handler/test_filter_taxonomy_index_tid/default/filter/tid', [], 'Expose filter');
+ $edit = ['options[expose_button][checkbox][checkbox]' => TRUE];
+ $this->drupalPostForm(NULL, $edit, 'Apply');
+ $this->drupalPostForm(NULL, [], 'Save');
+ $this->drupalLogout();
+ $this->drupalGet('test-filter-taxonomy-index-tid');
+ // Make sure the unpublished term isn't shown to the anonymous user.
+ $this->assertNotEmpty($this->cssSelect('option[value="' . $this->terms[0][0]->id() . '"]'));
+ $this->assertEmpty($this->cssSelect('option[value="' . $this->terms[1][0]->id() . '"]'));
+
+ // Tests that the term also isn't shown when not showing hierarchy.
+ $this->drupalLogin($this->adminUser);
+ $edit = [
+ 'options[hierarchy]' => FALSE,
+ ];
+ $this->drupalPostForm('admin/structure/views/nojs/handler-extra/test_filter_taxonomy_index_tid/default/filter/tid', $edit, 'Apply');
+ $this->drupalPostForm(NULL, [], 'Save');
+ $this->drupalLogout();
+ $this->drupalGet('test-filter-taxonomy-index-tid');
+ // Make sure the unpublished term isn't shown to the anonymous user.
+ $this->assertNotEmpty($this->cssSelect('option[value="' . $this->terms[0][0]->id() . '"]'));
+ $this->assertEmpty($this->cssSelect('option[value="' . $this->terms[1][0]->id() . '"]'));
+ }
+
}
--
GitLab