Empty feeds return all nodes

The bug persists, and is quite CRITICAL as I see it! (Reproduces only on 6.x)

It happens inside node.module, though. When blog.module (correctly) sends an empty array, node_feed() misunderstands that as missing argument (the default was also empty array there, so a random match occurs), and so the frontpage feed is built instead of honoring the (empty) data provided on the call.

The patch uses FALSE as default, to differentiate the empty array argument and no argument cases. Fixes the bug for me.

Probably the right fix, but perhaps not comprehensive enough.

The same case of array() may be present in http://api.drupal.org/api/function/taxonomy_term_page/6 and http://api.drupal.org/api/function/blog_feed_last/6, according to API references.

So the fix needs to address those cases as well. Perhaps you should also check the $channel array, since it is populated in the case of these three functions.

The two cases you mentioned and linked just call node_feed() in the same way as blog.module do, so these run into the same node.module bug too. But this patch fixes that as well, it's in fact the same bug, only just the background making the bug appear is duplicated on more places.

I tested another steps to reproduce, based on #6:
- On fresh install, add a Taxonomy vocabulary and a term, submit a node which is NOT inside that term. Go to the term's page (it's empty), and click the feed icon (the node is there, although it shouldn't be).
- Enable blog module, and go to the path 'blog' and its feed... Again, page empty but feed have the unrelated node.
- The same for 'blog/[uid]', which is the initial issue reported here.

So we're dealing with 3 problems here (at least - it's likely to happen on empty contrib feeds too), which makes this even more critical. The patch fixes it all. (As for checking $channel - I see no point in that, as it's always populated in the calls we deal with - and should be as phpdoc suggests. The fallback for argument-less call only applies to node.module internally, where node_feed() is used as a page callback for the main feed. The existing code is not checking $channel too, and I see no reason for that.)

Patch looks good to me. (I don't think I can actually test feeds without migrating my dev site to a live server?)

You can open feeds in browser, just like any other link. Firefox even shows it reasonably formatted. I tested this way on localhost.

Thank you. I needed to change my Firefox feed preferences to get the preview. Testing patch now.

Patch fixes the bug for both blogs and taxonomy.

This bug might have crept in with an "API cleanup". The docs said that arrays are to be passed. Anyway, I also updated the docs, so that it is documented what FALSE is supposed to do there. Thanks for the patch! http://cvs.drupal.org/viewvc.py/drupal/drupal/modules/node/node.module?r...