Breaks all views with non-private vocabulary based relationship

There is a function private_taxonomy_query_term_access_alter($query) which controls access to terms. If it can detect the vocabulary ID then it checks whether this is a private vocabulary and, if not, it exits which allows access. The problem is that queries can be almost anything. In the past there have been problems caused by using the machine name of the vocabulary instead of the vocabulary ID. If you can provide information about the query and why it is getting past the checks for whether it is a private vocabulary then I can fix the problem.

I think I've run into the same issue here with a simpler use case.

I have a Taxonomy Term View which is a simple list of fields: I'm showing term name and term ID. The vocabulary is not set to private and there are no other special permissions set around this vocabulary. However the results are only showing to administrator users, which is not the expected behaviour.

If I remove the term ID field then the view results *are* displayed to anonymous and non-admin users as expected.

View query:

SELECT taxonomy_term_data.name AS taxonomy_term_data_name, taxonomy_term_data.vid AS taxonomy_term_data_vid, taxonomy_term_data.tid AS tid, taxonomy_vocabulary.machine_name AS taxonomy_vocabulary_machine_name
FROM 
{taxonomy_term_data} taxonomy_term_data
LEFT JOIN {taxonomy_vocabulary} taxonomy_vocabulary ON taxonomy_term_data.vid = taxonomy_vocabulary.vid
WHERE (( (taxonomy_vocabulary.machine_name IN  ('personal_development')) ))

Thank you! I was able to reproduce the problem. The WHERE clause has two unnecessary parentheses. These are passed in the query object as nested conditions. The code was only checking the first level conditions. Since there is not any real reason to nest them that had never shown up. I change the code to recursively search for the conditions. The change is committed to the dev branch. Please verify before I can make a formal release.

Hello,

I've installed version 1.8 and the latest dev version (released 5th Jan 2017) but I'm still experiencing this issue. Is anybody else still experiencing this issue?

Thanks,
Bez

Can you supply more information so I can reproduce the problem?

Having the same problem using Drupal 8.5.6. A complex view using a non-private vocabulary is visible only to admins. I can disable SQL rewriting, but that's not acceptable for production.

You have told me that you have a problem but told me nothing els. Can you go to Structure -> Views and click on the Settings tab. Then check the Show the SQL query checkbox? Then you can preview your view and you should be able to see the query. If you can get that to me I can look through it to see if I can spot the problem.

I reproduced this with Drupal 8.9.1.

Steps to reproduce

1. Create a taxonomy vocabulary **Fruits** (not private, just accept defaults.)
2. Create terms Apples and Bananas.
3. Create a view that shows taxonomy terms of type **Fruits**. Use the page display. Accept defaults and save the view.
4. Go to the view page as an admin. You see Apples and Bananas.
5. Go to the view page as a non-admin authenticated user or as an anonymous. You don't see Apples or Bananas.

Expected behavior: I always see Apples and Bananas because I am not using a private taxonomy; I merely have the Private Taxonomy module enabled.

Attaching a patch with a test for this issue (don't know how to solve it, but I tried to write a test).

Trying again with a new patch.

Hmm, I'm not sure why the test in #13 is passing; I'm not very familiar with the testing framework.

I was worried that my steps to reproduce were wrong, so I did a clean install of D8 and installed only Private Taxonomy and followed the steps-- and I was able to reproduce the bug.

Thanks for the detailed information on how to create the error. I was able to reproduce the problem. Queries can take many form so it is difficult to catch all possibilities. In this case the conditions are nested which is what causes the problem. I rewrote the code so it is recursive so it can traverse the conditions.

Thank you for the quick patch!

With the patch, auth users can see the terms that belong to vocabularies that are not marked private as expected.

The testing module has been removed. I no longer can run tests locally. Google is just bringing up a lot of junk. I have no idea where to begin to fix the tests. I am going to need some help here.

For running Simpletest locally, I am using Lando.

There's a great blog post about this that was just released here: https://blog.lando.dev/2020/06/30/lando-drupal-contributions/

The advantage of lando is that it uses Docker so it's reasonably fast, and it also makes it very easy to completely blow away the environment and re-create it again.

I don't understand the changes in the patch well enough, but I was able to reproduce the Drupal CI test error manually.

1. Create a private vocabulary.
2. Have an admin user create a term in that vocabulary called "You can't see this".
3. Log in as an authenticated user with "administer own taxonomy" permission.
4. Go to /admin/structure/taxonomy/manage/my_private_vocabulary/overview.
5. The user can see the term "You can't see this".

@ptmkenny I cannot even bring up that page. It uses a #post_render callback and that is throwing an error. If you could review #3160192: #post_render callbacks must be trusted callbacks then I will get that fixed and I can then work on this issue.

I am testing this with Drupal 9.0.2 and Simpletest no longer exists. There is no testing module. It does not matter if I use Lando, it no longer is there.

I think I found the cause for the test failing.