Tags core.create

• is not tags usage / tags assignment

If something is to be patched is to prevent new tag creation, and not tags usage / tags assignment

Then if someone would want to treat core.create privelege the same way that core.create is used to prevent creation of articles inside a category,

• then you would want to check the core.create on every tag asset but there is no asset for individual tags

To be honest tags feature needs some more work

• fix frontend / backend forms allowing creation of tags to users without core.create
• add component level ACL privelege core.assign for assigning tags,
• optionally add ACL asset to individual tags (this would include at minimum the core.assign) to allow controlling assignments of individual tags If the last one is done, then ajaxifying tags assignment becomes a "must" because you would need to calculate ACL on possible thousands of individual tags, otherwise the form load would be considerable more slow in web-sites with 2,000 or 5,000 or very slow for 20,000+ tags

a much simpler alternative that i would want to suggest is creating 1 more property for tags:
"assign access level" besides the "view access level"

"assign access level" will be used for assigning tags
"view access level" will continue to be used for viewing

The above may seem strange usage of access levels, but would greatly improve calculation of tags allowed to a user to be assigned

• we don't really need individual assets to tags if we do the above

@ggppdk did you test?

In the frontend new article view (you can create a menu item of new article tipe to go to that form) you have the ability to select/create tags.

But if the user does not have permissions to create tags how can it be allowed to create tags?
The user can still select existing tags.

This PR only solves that

Please test

@andrepereiradasilva

i am sorry, i think miss-read the original issue report, thinking he meant tag assigments and tag creation both

the user is still able to create and send successful completion of the article with the tags added.

and i thought you wanted to prevent tag assignments, my mistake, but i see that the title of the issue is more clear

tested, yes, you are right it works (almost)

• but there is no server side validation

if someone manipulates the select element then can still create tags , since you would need to also add server side validation (i can still create tags by editing the select element directly) and adding:

    <option value="#new#form_tampered2" selected="selected">form_tampered2</option>

so this PR works but needs 1 more server side check
probably in (or in methods calling it):

JHelperTags::createTagsFromField()

Maybe the server side check should not be in:

JHelperTags::createTagsFromField()

• some code maybe passing to tags helper object method non sumbitted data thus that code woud be prevented from working

check should be at the same place where $form->validate() is called ?
libraries\legacy\controller\form.php

anyway someone should say best place for this,
still most easy and quick thing is to put check in:

JHelperTags::createTagsFromField()

ok, so i added server side validation. please test.
also, i don' t know the tags component very well, so please check if everything seems ok.

@andrepereiradasilva

Sure will test tomorrow, someone else may test too by then,

also why not update display() of view.html.php for backend form too ?

• i mean for article form , maybe another PR for all other forms

i mean for article form , maybe another PR for all other forms

if ok, the server side part is done in this PR + the new article form (frontend)

backend forms need to have the same change in another PR IMHO

actually thinking it better it this is for all tag field there must be a better way to not allow in all field at the same time.
So please don't test until i check that out.

ok, @ggppdk acl core.create check should now work in all tag fields

updated test instructions to be more clear. please test.

no volunteers to test?

I have tested this item ✅ successfully on 724abfe

User without ACL "create" on tags component, cannot create new tags in the article form

• form tampering to inject tag directly is (correctly) ignored during save:

<option value="#new#terrest" selected="selected">terrest</option>

User with ACL "create" on tags component, can create tags in the article form

I have tested this item ✅ successfully on 724abfe

RTC based on testing. Thanks