Parent Taxonomy Terms Not Restricting Access

I've experienced the same problem with the Drupal 5 version of the module. I found that this is due to the fact that no entry is created in node_access table for "parent" nodes.

In fact in the tac_lite_node_access_records module there's a strange query that select terms from term_data (td) with a LEFT JOIN with term_hierarchy (th) table ON td.tid = th.parent and WHERE th.tid IS NULL. I can't understand the meaning of this query.

Anyway, I think that for terms that are "leaf" of the terms tree the LEFT JOIN can't find a match (and so rows are kept), while for terms that are "parents" the LEFT JOIN find a match but the WHERE condition (that is always false) cuts the rows out!

Does anybody know the reason for this strange query?

I wrote that code, and even I don't know why that clause is in there. I think I copied it from some example in the 4.7 taxonomy module. But I just looked in the taxonomy module (Drupal 5) and didn't see anything like that in there. There's probably no reason for it, and it seems to cause this problem. Have you tried removing it? It would be great if you tried that in your environment and if it solves the problem, please submit a patch.

Thanks.

I tried to patch the code and it seems to me that now everything works. I simply remove the LEFT JOIN with the term_hierarchy table (since I think it's useless at all), however I left the query just to select terms that belongs to one of the vocabularies used by tac_lite.

Here is my patch. I replaced the original code in tac_lite_node_access_records:

$result = db_query("SELECT DISTINCT td.tid FROM {term_data} td LEFT JOIN {term_hierarchy} th on td.tid = th.parent WHERE td.vid IN (%s) AND td.tid IN (%s) AND th.tid IS NULL",
	   implode(',', $vids),
	   implode(',', $all_tids));

with the following code:

$result = db_query("SELECT DISTINCT td.tid FROM {term_data} td WHERE td.vid IN (%s) AND td.tid IN (%s)",
	   implode(',', $vids),
	   implode(',', $all_tids));

Sorry I don't know how to make a real file patch (I suspect I have to do it with diff, but I'm on a Windows system). Anyway, I hope it can help.

I can confirm the bug, and confirm that the solution described by pixel13 appears to fix the problem.

I'm travelling for some weeks, but will confirm this and check in the patches when I get a chance. Sorry for the delays.

Does anyone know how to recode the query

$result = db_query("SELECT DISTINCT td.tid FROM {term_data} td WHERE td.vid IN (%s) AND td.tid IN (%s)",
implode(',', $vids),
implode(',', $all_tids));

so that all children of the parent taxonomy term are visible to the user, not just the parent term itself?

This would be useful especially when new child terms are added. Currently, I would need to go back through every user and grant them access to the child term. Any ideas? Thanks!

Take a look at the taxonomy module. There are several functions for getting child or parent terms.

I figured it out -- to allow a user automatic access to child taxonomy terms, change the following lines of code (around line 227) in the function "tac_lite_node_access_records" from:

while ($term = db_fetch_object($result)) {
	  $tids[] = $term->tid;
	}

to

while ($term = db_fetch_object($result)) {
	  $tids[] = $term->tid;
	  foreach(taxonomy_get_parents_all($term->tid) as $parent_term) 
	  {
	  	if (!in_array($parent_term->tid, $tids)) $tids[] = $parent_term->tid;
	  }
	}

and viola, taxonomy permissions will cascade downstream. Any suggestions are greatly appreciated. I hope this will eventually become a tac_lite setting.

Can also confirm that this is a bug and that pixel13's patch works.

Encountered the same problem, eventually found this and it has fixed my problem with parent term access restrictions too.

Many thanks!

@mclemmens: It is a fairly well known fact that looping structures are much faster with pre-computed values rather than function calls. So I would recommend this small amendment:

while ($term = db_fetch_object($result)) {
  $tids[] = $term->tid;
  $parents = taxonomy_get_parents_all($term->tid);
  foreach($parents as $parent_term) {
    if (!in_array($parent_term->tid, $tids)) $tids[] = $parent_term->tid;
  }
}

But I agree that this is a valuable addition to TAC_Lite and would have prevented me from having to use a full blown TAC, with all its attendant problems, on one site.

Patch #4 applied to DRUPAL-5.

Sorry it took me so long. I dropped the ball on this.

Regarding the inheritance mentioned in #9 and #11, I'm torn about this. It seems like it's diverging from the way taxonomy works. I mean, the node is tagged only with the parent term, not the children. It seems like what you "really want" is when tagging a node with a child term, it automatically gets tagged with the parent terms as well. At any rate, for further consideration submit it as a seperate feature request.