TYPO3 Core

Stumbled over the same issue using TYPO3 6.0.6.

The problem is that CategoryCollection->getCollectedRecords() fetches all records assigned to a given category, no matter from which table.

Imagine you have a page with uid 1 and a news entry with uid 2, both assigned to category 99. Additionally you have a page with uid 2, not assigned to any category.

When trying to fetch all records from table pages which are assigned to category 99 the following will happen. getCollectedRecords() finds each and every entry with category 99 (no matter from which table), extracts its uid and joins the result with the target table (pages). This produces one entry for the above mentioned news record (as the category matches) which is then successfully joined with the "pages" record having uid 2.

This results in wrong category collections.

This example will only work, if the uid of the news record is also available as a valid uid from pages table.

CategoryCollection->getCollectedRecords() has to be modified:
Wrong:
$resource = $this->getDatabase()->exec_SELECT_mm_query($this->getItemTableName() . '.*', self::$storageTableName, 'sys_category_record_mm', $this->getItemTableName(), 'AND ' . self::$storageTableName . '.uid=' . intval($this->getIdentifier()));

Correct:
$resource = $this->getDatabase()->exec_SELECT_mm_query($this->getItemTableName() . '.*', self::$storageTableName, 'sys_category_record_mm', $this->getItemTableName(), 'AND ' . self::$storageTableName . '.uid=' . intval($this->getIdentifier()) . ' AND sys_category_record_mm.tablenames = "' . $this->getItemTableName() . '"');

Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/21963

Patch set 1 for branch TYPO3_6-1 has been pushed to the review server.
It is available at https://review.typo3.org/22366

Patch set 1 for branch TYPO3_6-0 has been pushed to the review server.
It is available at https://review.typo3.org/22367