I'm working on deriving an image_gallery_access module from forum_access, and the following hook function gives me trouble:

/**
 * Because in order to restrict the visible forums, we have to rewrite
 * the sql. This is because there isn't a node_access equivalent for
 * taxonomy. There should be.
 */
function forum_access_db_rewrite_sql($query, $primary_table, $primary_field, $args) {
  if ($primary_field == 'tid' && !user_access('administer forums')) {
    global $user;
    $roles = _forum_access_get_roles($user);
    $sql['join'] = "LEFT JOIN {forum_access} fa ON $primary_table.tid = fa.tid LEFT JOIN {acl} acl ON acl.name = $primary_table.tid AND acl.module = 'forum_access' LEFT JOIN {acl_user} aclu ON aclu.acl_id = acl.acl_id AND aclu.uid = $user->uid";
    $sql['where'] = "(fa.grant_view >= 1 AND fa.rid IN ($roles)) OR fa.tid IS NULL OR aclu.uid = $user->uid";
    $sql['distinct'] = 1;
    return $sql;
  }
}

This rewrites any SQL query that retrieves tids to create a pretty hefty SELECT statement. I need to do essentially the same thing for image_gallery_access, and if both access modules are active, they both add two joins!

This is a very inelegant, unsafe, and probably also inefficient way of doing things. Can it be improved somehow?

One idea is to put my grant records into your forum_access table and let you do all the SQL rewriting. I guess I would have to check whether forum_access is installed and active, and if it wasn't, I'd have to do it myself, but if forum_access_enabled() returned TRUE, I could leave it to you. The problem with this idea is that the user might have the administer forums permission, and then forum_access wouldn't restrict the taxonomy at all. No good...

Could forum_access and image_gallery_access delegate the SQL rewriting to the acl module? After all, we're querying acl tables here. Are there other modules that use taxonomy in this way and that could also benefit?

Is there any push to create a taxonomy access hook in core?

Comments

salvis’s picture

Status: Active » Closed (works as designed)