Closed (fixed)
Project:
Views (for Drupal 7)
Version:
7.x-3.x-dev
Component:
Miscellaneous
Priority:
Critical
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
15 May 2010 at 09:12 UTC
Updated:
28 Aug 2010 at 08:40 UTC
Jump to comment: Most recent file
Comments
Comment #1
dawehnerHere is a first patch. I thought formula would be even better.
I'm not sure whether this is the best way to implement it, but it works at least
Comment #2
dawehnerUps i forgot the attachment
Comment #3
dawehnerI'm not sure about it, but i only found SUBSTRING as example in d7 core, so i guess this could be better.
Rerole
Comment #4
dawehnerWHERE (( (SUBSTRING(node.title, 1, 1)= :views_handler_argument_string) ))
This does not look like a good codestyle :)
PS: I'm not sure about the name of the placeholder here
Comment #5
dawehnerDamZ suggested to use a field + alias and a simple condition.
I tryed this, but the fieldalias do not to work here
Here is the code for this approach.
Comment #6
dawehnerSince #769554: Trivial SQL injection(s) with SelectQuery every complex field, is broken
Examples are
Comment #7
Crell commentedFor something like a SUBSTRING call, you want to be using ->where(), not ->condition(). That just wasn't properly enforced until the patch mentioned in #6 went in, when it became necessary for security to do so.
->where("SUBSTRING(node.title, :start, :length)", array(':start' => 1, ':length' => 1)) should work. (Or something like that.) Remember the placeholders for proper injection safety.
Also, don't worry about the excessive parentheses. The DB layer is very liberal with parenthesis so as to make sure it doesn't miss any and introduce subtle bugs. It shouldn't hurt anything.
Comment #8
karens commentedI've run into this now trying to do complex queries for Date and Calendar, would love to find a solution. The approach in #4 looks logical to me, I don't really understand #5. And I already saw in the dbtng documentation that we need ->where() instead of ->condition(), so I'm glad to see someone working on this solution.
Comment #9
karens commentedThe patch above worked for me, but I tried to incorporate Crell's comments by making a simple change, which did not work. I just swapped in one more placeholder and added the placeholder to the args() array. This certainly looks like it should work but it blows up completely.
After some analysis I think I see the problem. That formula is used in the WHERE clause but it is also used as a field, and my 'fix' changed a field with no placeholders into a field with placeholders. The current Views code does not know anything about placeholders in fields. The compile_fields() function checks for fields that are formulas and uses addExpression() on them, which is right, but there is no provision for passing placeholders to that function, which is also going to be necessary to support complex queries. I can tell you for sure that Date module has fields which are formulas and I'm sure there are others.
So we need to stretch this patch to provide a way to supply placeholders for formula fields that need them as well as take care of the formula in the WHERE clause.
Comment #10
webchickSubscribing for now. Obviously, very interested in helping however I can from the Drupal core side to make Views work in D7. :)
Comment #11
karens commentedChanging the title and marking this critical, since even some built-in views that used to work are now broken
Comment #12
karens commentedSo here's a stab at fixing both problems by using the $params in add_field to add a param for a 'placeholders' array. Then we just add that to ->addExpression(). This patch doesn't work, I get an error 'Unsupported operand types in ...views/plugins/views_plugin_query_default.inc on line 667' that I can't figure out, but I think the approach could work if someone can see what I did wrong.
Comment #13
karens commentedSomehow I reverted the status when I added the patch.
Comment #14
dawehnerOh this was a easy problem
This is just one additional parameter.
With this the glossary view works fine again, but the archive still does have problems.
Comment #15
karens commentedYay! Yes, glossary is fixed with that. Now going to see if I can use this change to fix archive and date views.
Comment #16
karens commentedHere's a patch updated with a fix for the archive view. I haven't tried this on the Date module yet, but I think this is looking like a workable system.
Comment #17
karens commentedActually made one small change, just for clarity in reading the code. When we change the argument to an array of placeholders, I changed the name of the variable to $placeholders rather than $argument.
Comment #18
aschiwi commentedGreat! I have a working glossary and archive view with this patch. Can't see any errors or anything else that might have been broken along the way. Archive works with both page and block view.
Comment #19
dawehnerThe code looks fine i think i will commit it.
Any reasons against it?
Comment #20
karens commentedI was going to be sure it would also work for Date but hopefully if I find other changes are needed you will help me get them committed as follow-on patches. This much at least gets some of the important core views working again and provides a method for other modules to do some more complex queries.
So I would say go ahead and commit it :)
Comment #21
karens commentedAnd it also gets rid of the error messages in the Date filter and arguments. They still have other things broken, but getting this much working right is huge. Now I can pass my complex date queries to Views and Views can handle them in a meaningful way.
Comment #22
dawehnerThanks a million!
I tested it again and commited it
Comment #23
webchickYAY!! Thank you so much, all! :D
Comment #24
aschiwi commentedI just noticed that comments_recent still seems to be "broken". I'm no good at writing patches for PHP code so here's just a report :)
Comment #25
aschiwi commentedI guess this needs to be "needs work" then.
Comment #26
aschiwi commentedDid some more testing. Tracker view is fine, but taxonomy_term is not and I also cannot add a rather simple list of taxonomy terms without the
PDOException: SQLSTATE[42S02]: Base table or view not founderror message. "backlinks" View as well as "frontpage" seem to work just fine as well.Comment #27
dawehnerPerhaps we should create new issues. This one is already quite full.
It's sadly known that taxonomy_term is not working at the moment, but what should i say taxonomy data structure in d7 is not perfect for views.
I don't think i will be able to fix this before drupalcon. I think the days on drupalcon should have 48hours.
#722454: Fix taxonomy integration
The node: status filter is currently broken because views query substitions does not work.
#812970: Get Views Query substitutions working
Did someone claimed that dbtng would help views?
I would suggest to mark this issue as fixed and create new small issues.
Comment #28
karens commentedI suspect we haven't uncovered a complete list of all the affected places. We need to start identifying them and then we can fix them. The core fix is still good and at least *some* of the views are working now.
Comment #29
aschiwi commentedOkay, marking this as fixed. The only other thing I found concerned taxonomy and there's already an issue for it. Thanks guys.