From http://www.angrydonuts.com/anyone-want-to-write-a-couple-of-views-1-patc...
Views is using taxonomy api to get a list of vocabularies and terms, but because this gets run through db_rewrite_sql, if the current user doesn't have access to vocabularies/terms due to a module, then these vocabularies and terms are excluded from the views data, which then causes views that actually utilize them to suddenly and mysteriously fail. This can be alleviated by not using the taxonomy module API and fetching directly from the database, in order to avoid db_rewrite_sql issues.
I believe this is referring to the call to $vocabularies = taxonomy_get_vocabularies(); in modules/taxonomy_views.inc, which has the db_rewrite_sql() stuff in it.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | views_taxonomy.inc_.patch | 3.04 KB | mr.j |
| #2 | taxonomy_views_avoid_sql_rewrite.patch | 3.1 KB | mlncn |
Comments
Comment #1
mlncn commentedOn it.
I think these functions need to be re-implemented:
taxonomy_views_node_get_terms
taxonomy_views_node_get_terms_by_vocabulary
taxonomy_get_vocabularies
Comment #2
mlncn commented(Correction to above: taxonomy_node_get_terms and taxonomy_node_get_terms_by_vocabulary need to be reimplemented and I used the names given above in their reimplementation.)
This patch should do it, if I understood the problem correctly.
Thanks webchick for making Earl's requests into issues!
benjamin, Agaric Design Collective
Comment #3
aclight commentedBy intentionally avoiding db_rewrite_sql(), then isn't Views providing a potential mechanism for access elevation if a site is using some kind of taxonomy access control module?
Comment #4
jbrauer commentedI haven't looked at the patch but in contemplating this and the problem aclight raises in #3 I though perhaps a new permission that should perhaps be setup to specifically grant this permission to roles intentionally. I haven't investigated enough to say this is the right way to go.
Comment #5
merlinofchaos commentedThe reason to avoid db_rewrite_sql here is that rebuilding the cache is completely unrelated to the user who's actually doing it. It's *not* per user. THe cache is supposed to be the total cache of all information that's available.
The actual view that gets run later is still run through db_rewrite_sql, so theoretically taxonomy_access or similar modules should then go ahead and put in their restrictions, thus limiting what is available.
Thanks, Benjamin! I'll look at this more closely later today, after I've had some coffee.
Comment #6
merlinofchaos commentedhttp://drupal.org/node/83490 is duplicate of this.
Comment #7
dwhite10701 commentedI tried the patch, but I'm still having the same problem.
I'm using Drupal 5.6
Comment #8
dinis commentedCheers for this patch, it resloved the issues I was having with some views becoming corrupt and a MySQL error in the log.
Details about my issue here: http://drupal.org/node/312138
Comment #9
bsnodgrass commentedDrupal 5.12, Views 5.x-1.6, MySQL database 5.0.51a, PHP 5.2.4-2ubuntu5.3...
The patch appeared to work for us, and would for a period of time with exposed filters, however after a time memory would fill (presumably from cache) and our site would go down. We ended up removing the patch and backing off using exposed filters on our calendar view.
We are also using Taxonomy Access Control, the exposed filter was using a calendar category on Calendar (5.x-2.5) View
Comment #10
mr.j commentedSubscribing. Patch working so far.
Comment #11
mr.j commentedI just downloaded 1.7 and it looks like this patch never made it.
Patch against 1.7 attached.
Comment #12
merlinofchaos commented1.7 was released due to the security issue. I'm not actually maintaining Views 1, except that I kind of had to do that. The actual 1.7 maintainer has kind of bailed on it. So I dunno if anyone will ever look at this.
Comment #13
mr.j commentedNo problem, I am actually upgrading all my modules in preparation for a move to D6.
Comment #14
esmerel commentedAt this time, only security fixes will be made to the 5.x version of Views.