Wrong usage of db_rewrite_sql
grafsl - October 14, 2009 - 12:43
| Project: | Zeitgeist |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | fgm |
| Status: | needs review |
Description
There are few calls of db_rewrite_sql in zeitgeist.module (566, 677, 685, 935) only with one argument - the query to rewrite. So, db_rewrite_sql tries (in my case) to join table 'node_access' on nid. But none of used queries contain table 'node' in FROM phase and i've got an error message:
user warning: Unknown column 'n.nid' in 'on clause' query: SELECT zg.search, zg.category FROM zeitgeist zg INNER JOIN node_access na ON na.nid = n.nid WHERE (na.grant_view >= 1 AND ((na.gid = 0 AND na.realm = 'all'))) ORDER BY zg.ts DESC in D:\projects\ilay\sites\all\modules\zeitgeist\zeitgeist.module
What for db_rewrite_sql is used?
#1
Looks like a bug indeed.
Problem is, ZG has no PK (for good reason: it's just an archive log that can actually contain fully duplicated rows; it would have to be a meaningless serial id), and I don't see on what field one could want to apply access control to, for the rewrite. And yet, any list in Drupal is usually expected to provide some way to hook an access control to its execution. Any suggestion ?
#2
But ZG contains only the user input with no strict relation to site content (node, user, taxonomy, ...). We use word filter to prevent "bad words" from adding to ZG stats. And it's our 'access control'.
I think, unless ZG would contain any references to users, nodes or something else no access control should be used.
#3
Well, someone might want to use access control to filter results based on search terms, so I fixed the db_rewrite_sql calls to apply to the ZG table. Can you try this patch ?
#4
Hi,
I looked through your patch and didn't find implementation of hook hook_db_rewrite_sql. So function calls db_rewrite_sql($sq, 'zg', 'search') shouldn't affect queries.
But i can't imagine how result can be filtered based on search terms: search term is a word, not a phrase like in ZG. The result query should use "like" with using % which made it very heavy.
In other hand, this patch just gives opportunity for other developers to filter query results without changing your code. I'll try it tomorrow.
#5
That's exactly the idea: prevent db_rewrite_sql from firing inadvertently, and yet allows someone to use it to filter results.