Integrate with Term Access

I was helping to fix an issue in Domain Taxonomy and the noticed that term access was being bypassed. This should be tagged with term_access

One example query is:

    // TODO Please convert this statement to the D7 database API
syntax.
    $result = db_query('SELECT t.tid, t.*, parent FROM
{taxonomy_term_data} t INNER JOIN  {taxonomy_term_hierarchy} h ON t.tid
= h.tid WHERE t.vid = :vid ORDER BY weight, name', array(':vid' =>
$vid));

see taxonomy_get_tree() for an example.

So something like:

$query = db_select('taxonomy_term_data', 't');
    $query->join('taxonomy_term_hierarchy', 'h', 'h.tid = t.tid');
    $result = $query
      ->addTag('translatable')
      ->addTag('term_access')
      ->fields('t')
      ->fields('t', array('parent'))
      ->condition('t.vid', $vid)
      ->orderBy('t.weight')
      ->orderBy('t.name')
      ->execute();

? Since you're actually using this, I'd appreciate it if you could roll a patch based on the above, test it and report it back :)

I was helping out with Domain Taxonomy which is vital for a project that we are working on, and there was an issue there that suggested that it had this issue. So 2 hours solid debugging failed to find issues there, I tracked the issue down to this module instead.

The parent field looks wrong above, shouldn't this be:

      ->fields('t')
-      ->fields('t', array('parent'))
+      ->fields('h', array('parent'))

You're absolutely right!

I'm running into this issue, too, but changes don't seem to be in the dev release. Would anyone like to help roll up a patch?

I made the above changes and created a patch. Please review it. Ideally we'll add more for the other queries but this is a fix for this particular issue.

This is not really a bug, neither a security problem. The problem is that the term_access module cannot enforce anything because it is not part of the Drupal core taxonomy module. It cannot be regarded as a bug, only as a feature request.

That being said, #7 was confirmed by #8, so I've committed it :)

Thanks!

http://drupalcode.org/project/hierarchical_select.git/commit/a79c119