Better validation is needed for the taxonomy_term resource in general, and specifically on Term Create. In some cases, passing bad data to this service results in creation of orphaned data.

For instance, when I enter a non-linear term ID while using the create action, if the term has a custom field, that field is created, with the passed tid, but the term itself is never created.

For Instance:

Assume my last created linear term id was 500. Then I'll pass the following:

{
  "tid": 123459999,
  "name": "Coffee 123459999",
  "vid":2,
  "field_custom_field": {
      "und": [
          {
             "value": "coffee123459999"
          }
      ]
  }
}

When I pass this to the create service, I get an entry in my custom field table (field_data_field_custom_field) with the value for my custom field, assigned to entity "123459999," but no record of this entity in the taxonomy term data table.

I checked the taxonomy_term create callback, which uses taxonomy_term_save() to create the data. However, this function notes that when no tid is present, a new record is created. If a tid is present, an update is assumed.

By this logic, the taxonomy service should not allow a tid to be passed during a create action. As written, this can cause pollution of the database.

There is some mention of better validation for terms in: https://www.drupal.org/node/1539138, but this is a pretty specific issue, and I would think it's easy to correct in a few lines of code.

Comments

Atomox’s picture

Title: Better Validation for Taxonomy » Orphan data on Taxonomy Term Create (better validation needed)
marcingy’s picture

Version: 7.x-3.7 » 7.x-3.x-dev
Priority: Major » Normal

This makes sense as a bug. I would say services should return an error if a tid is provided. If you provide a patch we will look to get it committed. A test would also be nice.

Down grading to normal as it is possible to override the callback as it stands, perform the validation and then call the existing callback (Messy I agree but certainly a work around).

kylebrowning’s picture

Status: Active » Closed (won't fix)

Cleaning issue queue, if you want to work on this, re-open the ticket.