Better validation is needed for the taxonomy_term resource in general, and specifically on Term Create. In some cases, passing bad data to this service results in creation of orphaned data.
For instance, when I enter a non-linear term ID while using the create action, if the term has a custom field, that field is created, with the passed tid, but the term itself is never created.
For Instance:
Assume my last created linear term id was 500. Then I'll pass the following:
{
"tid": 123459999,
"name": "Coffee 123459999",
"vid":2,
"field_custom_field": {
"und": [
{
"value": "coffee123459999"
}
]
}
}When I pass this to the create service, I get an entry in my custom field table (field_data_field_custom_field) with the value for my custom field, assigned to entity "123459999," but no record of this entity in the taxonomy term data table.
I checked the taxonomy_term create callback, which uses taxonomy_term_save() to create the data. However, this function notes that when no tid is present, a new record is created. If a tid is present, an update is assumed.
By this logic, the taxonomy service should not allow a tid to be passed during a create action. As written, this can cause pollution of the database.
There is some mention of better validation for terms in: https://www.drupal.org/node/1539138, but this is a pretty specific issue, and I would think it's easy to correct in a few lines of code.
Comments
Comment #1
Atomox commentedComment #2
marcingy commentedThis makes sense as a bug. I would say services should return an error if a tid is provided. If you provide a patch we will look to get it committed. A test would also be nice.
Down grading to normal as it is possible to override the callback as it stands, perform the validation and then call the existing callback (Messy I agree but certainly a work around).
Comment #3
kylebrowning commentedCleaning issue queue, if you want to work on this, re-open the ticket.