[Regression] Missing JOIN in attached display with taxonomy filter and inherited exposed filter

Synopsis

If you have an attachment display that inherits exposed filters from another display and both displays share an exposed filter on a taxonomy term that has the Reduce duplicates setting enabled, the attachment display will not show any results, if the exposed taxonomy term filter is used.

Discussion

This is a regression introduced by the recent SA-CONTRIB-2019-035 security update (commit fbafd79a).

The query for the attachment display is missing a left join to the taxonomy term data table. As part of the security update, the code line that added the table previously was moved inside an if branch so that it will be added only if the property many_to_one_aliases of the view doesn't yet contain an alias for the field in question. Since the query for the attachment display is generated by a view that has been cloned from the original view using the clone_view() method and this property is not unset when cloning the view, it is still present from the original query building process for the parent display so adding the JOIN is skipped inadvertently.

Proposed resolution

I think the best solution for this would be to leave the security fix as is and just add the many_to_one_aliases property as an additional property to remove in clone_view(). The many_to_one_tables property is already removed there and it makes sense to do that for the aliases as well, since the query is rebuilt anyway. However, I am not entirely sure, what other consequences that might have, since I don't know the code base well enough. Hopefully a maintainer or fellow community members can add additional insight, if this is a sensible solution.

Also, there seem to be some similar, but not entirely identical issues caused by the security update, so maybe a broader approach is needed after all.

Steps to reproduce

Reduced test case:

1. Install Drupal 7.x (default profile) in English.
2. Install Views and Views UI 7.x-3.21/dev.
3. Create one Article with tag views.
4. Create a new view using the default settings. Chose any name you like.
5. Add a filter for the Tags<7em> field. Make sure to check Expose this filter to visitors, to allow them to change it and Reduce duplicates.
6. Add an attachment display.
7. In Attachment settings > Attach to select Page.
8. In Attachment settings > Inherit exposed filters select Yes.
9. Save view.
10. Navigate to the page of your view and select the tag views in the exposed filter. Click Apply.

Expected result

The article you created is visible two times (once shown by the page display, once shown by the attachment display).

Actual result

The article you created is visible only a single time (shown by the page display), since the JOIN to the taxonomy data table is missing from the query for the attachment display.

Attachments

• Export of the reduced test case view
• Diff of two queries for the same view from before the update and after the update to 7.x-3.21. The upper query is the query from the attachment display, the lower query is the query from the parent display. The query is a bit more complex than for the reduced test case, since I created this in a development environment of an actual site with a more complex display.