By merlinofchaos on

For different users, the /poll list generates inconsistent values for the vote counts. For the admin account, for example, the numbers are correct. For at least one account, the numbers are doubled, and for another, the numbers are tripled.

I've gone into the code and looked into the query that generates those numbers, and my guess is that the joins are generating double and triple links to the poll_choices table, but I can't explain how or why (and I'm not very good at sql join syntax)

Comments

merlinofchaos’s picture

merlinofchaos commented

Ok, I tracked this one down too.

It has to do with taxonomy_access(), which had a query rewrite hook to make sure that the nodes are viewable to the user.

However, if the viewer in question happens to have multiple roles that have access (and doesn't have administer_nodes access which short circuits the access checks entirely) then for every role after the first, new copies of the very same poll results end up in the query.

To hack a fix, I removed access to 'view uncategorized nodes' in the taxonomy_access setting to the 2 roles, which means the 3rd role is now required. I'm not sure this makes much sense, so let me explain my setup.

I have authenticated_user, which has privileges to view uncategorized nodes.

I also have editor, author and moderator roles; I wanted these to be specific, so they're just tacked on atop authenticated_user.

author and moderator also have access to view uncategorized nodes. If a user was an authorized_user and an author and/or moderator, the number of votes in the polls would appear to be doubled (or tripled if the user had all 3).

I have no idea how to fix the query, it's a little beyond my SQL knowledge.

-- Merlin

[Read my writing: ehalseymiles.com]
[Read my Coding blog: Angry Donuts]

castellan’s picture

castellan commented

The problem seems to be within the db_rewrite_sql() implementation. In my case, I'm not using taxonomy_access(), but node_privacy_by_role. Same issue. Before the db_rewrite_sql() function, the query was fine, but afterward, it was a real mess.

My short-term solution was to comment out the db_rewrite_sql() function, though I'll probably need to see what the privacy_by_role module is doing that's causing the misbehavior.