ANCIR / grano

A toolkit for mapping networks of political and economic influence through diverse types of entities and their relations. Accessible at http://granoproject.org
http://granoproject.org
MIT License
188 stars 28 forks source link

Permission check may double number of returned rows #59

Closed stefanw closed 10 years ago

stefanw commented 10 years ago

These lines join permissions to the result set. However, the user may be allowed to access the project for two different reasons: 1. because the project is not private, 2. because he has read permissions. If both of these are true, the result set doubles.

One possible solution would be to DISTINCT the result set on id, but I would actually recommend not writing JOINs for permission checks.

pudo commented 10 years ago

Damn that was stupid. Too tired.