image galleries and tac_lite access conflict

Found the security risk:
On the "my account" page the user can access tac_lite settings for themselves and change thier level of access.

I closed this as I looks like this has more to do with the image.module than tac_lite. Thanks.

Moving to image.module

Excellent - just the guy I'd want to talk to then! Yes the module is behaving exactly as you describe. All users can view all the image galleries. Which is actually bad. I just hadn't found that until after I brought up the other issue. Please let me know how I can help you. How I can help you help me! ;)

Thanks a lot - I guess I should move this back to tac_lite...

I added the ORDER BY fields to the SELECT statements in the two query strings in function image_gallery_page. They end up looking like this:

/**
 * Image gallery callback, displays an image gallery
 */
function image_gallery_page($type = NULL, $tid = 0) {
  $galleries = taxonomy_get_tree(_image_gallery_get_vid(), $tid, -1, 1);
  for ($i=0; $i < count($galleries); $i++) {
    $galleries[$i]->count = taxonomy_term_count_nodes($galleries[$i]->tid, 'image');
    $tree = taxonomy_get_tree(_image_gallery_get_vid(), $galleries[$i]->tid, -1);
    $descendant_tids = array_merge(array($galleries[$i]->tid), array_map('_taxonomy_get_tid_from_term', $tree));
    $last = db_fetch_object(
      db_query_range(
        db_rewrite_sql(
          'SELECT n.nid, n.sticky, n.created
          FROM {node} n 
          INNER JOIN {term_node} tn 
          ON n.nid = tn.nid 
          WHERE tn.tid IN (%s) 
          AND n.status = 1 
          ORDER BY n.sticky DESC, n.created DESC'
        ), 
        implode(',', $descendant_tids), 0, 1
      )
    );
    $galleries[$i]->latest = node_load(array('nid' => $last->nid));
  }

  $images = array();
  if ($tid) {
    $result = pager_query(
      db_rewrite_sql(
        "SELECT n.nid, n.sticky, n.created
         FROM {term_node} t 
         INNER JOIN {node} n 
         ON t.nid=n.nid 
         WHERE n.status=1 
         AND n.type='image' 
         AND t.tid=%d 
         ORDER BY n.sticky DESC, n.created DESC"
      ), variable_get('image_images_per_page', 6), 0, NULL, $tid
    );

This fixed the first error I was getting but the other persisted:

warning: pg_query() [function.pg-query]: Query failed: ERROR: invalid input syntax for integer: "" in /usr/share/drupal/includes/database.pgsql.inc on line 84.
user warning: query: SELECT n.nid, n.vid, n.type, n.status, n.created, n.changed, n.comment, n.promote, n.moderate, n.sticky, r.timestamp AS revision_timestamp, r.title, r.body, r.teaser, r.log, r.format, u.uid, u.name, u.picture, u.data FROM node n INNER JOIN users u ON u.uid = n.uid INNER JOIN node_revisions r ON r.vid = n.vid WHERE n.nid = '' in /usr/share/drupal/includes/database.pgsql.inc on line 103.

I was unable to track down anything in the image_gallery.module or the tac_lite.module having to do with this error. So, I went and created a new Drupal installation and started over with these two modules, thinking that perhaps the error was having to do with the other error saving a wrong setting in the database.

The good news is that the new installation worked! No errors. Tested all options and configurations that I could think of. the bad news is that I have put A LOT of work into my installation that is still getting the errors, and I could really use some help finding that bug and getting it out of my database!

I've tried:
- enabling/unenabling the gallery and tac_lite modules
- removing some image gallery related row in the variable and vocabulary database tables
- dropping all the image nodes and recreating them as well as the gallery pages

Any other suggestions? I should probably post this on the forums... more traffic.

This revision should be implemented into the repository

Thank you! Jamie.

Tracked down the other error. It had nothing to do with a clean installation. Here is are the patches. I've done two more but can't commit into this project. Someone please help.

First one fixes the error messages that result from querying when there are no nodes showing up in a gallery:

/**
 * Image gallery callback, displays an image gallery
 */
function image_gallery_page($type = NULL, $tid = 0) {
  $galleries = taxonomy_get_tree(_image_gallery_get_vid(), $tid, -1, 1);
  for ($i=0; $i < count($galleries); $i++) {
    $galleries[$i]->count = taxonomy_term_count_nodes($galleries[$i]->tid, 'image');
    $tree = taxonomy_get_tree(_image_gallery_get_vid(), $galleries[$i]->tid, -1);
    $descendant_tids = array_merge(
          array($galleries[$i]->tid), array_map('_taxonomy_get_tid_from_term', $tree));
    $db_rewrite_var = db_rewrite_sql(
      'SELECT n.nid, n.sticky, n.created
       FROM {node} n 
       INNER JOIN {term_node} tn 
       ON n.nid = tn.nid 
       WHERE tn.tid IN (%s) 
       AND n.status = 1 
       ORDER BY n.sticky DESC, n.created DESC'
    );
    $db_query_range_var = db_query_range($db_rewrite_var, implode(',', $descendant_tids), 0, 1);
    $last = db_fetch_object($db_query_range_var);
    if($last->nid > 0) { $galleries[$i]->latest = node_load(array('nid' => $last->nid)); }
  }

The important line is:
if($last->nid > 0) { $galleries[$i]->latest = node_load(array('nid' => $last->nid)); }
The rest of the changes were just so that I could debug.

The second patch just hides the display of the gallery if there are no images in it (or if no images show up because of tac_lite - the gallery page itself can't be controled by tac_lite because it is not a node)

/**
 * Theme a gallery page
 */
function theme_image_gallery($galleries, $images) {
  drupal_set_html_head(theme('stylesheet_import', base_path() . drupal_get_path('module', 'image_gallery') .'/image_gallery.css'));
  //
  // We'll add height to keep thumbnails lined up.
  $size = _image_get_dimensions('thumbnail');
  $width = $size['width'];
  $height = $size['height'];
  //
  $content = '';
  if (count($galleries)) {
    $content.= '<ul class="galleries">';
    foreach ($galleries as $gallery) {
      if ($gallery->count > 0) {
        $content .= '<li style="height : '.$height .'px">';
        if ($gallery->count)
          $content.= l(image_display($gallery->latest, 'thumbnail'), 'image/tid/'.$gallery->tid, array(), NULL, NULL, FALSE, TRUE);
        $content.= "<h3>".l($gallery->name, 'image/tid/'.$gallery->tid) . "</h3>\n";
        $content.= '<div class="description">'. check_markup($gallery->description) ."</div>\n";
        $content.= '<p class="count">' . format_plural($gallery->count, 'There is 1 image in this gallery', 'There are %count images in this gallery') . "</p>\n";
        if ($gallery->latest->changed) {
          $content.= '<p class="last">'. t('Last updated: %date', array('%date' => format_date($gallery->latest->changed))) . "</p>\n";
        }
        $content.= "</li>\n";
      }
    }
    $content.= "</ul>\n";
  }

Here the important lines are:
if ($gallery->count > 0) {
and the '}' that closes the statement.

I really hope this helps someone else, as I've spent more time on it than I'd have liked. ;)

I'm attaching the revised image_gallery.module for someone to commit. Thanks!

Thanks for bearing with me - my first patch file... There are a few style changes that show up in the patch file that aren't really necessary, but that helped me troubleshoot. If you don't like them, can you just edit the patch file? Let me know if I should do something. Thank you!