Bugzilla – Attachment 123467 Details for
Bug 28784
DoS in opac-search.pl causes OOM situation and 100% CPU (doesn't require login!)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 28784: Remove code related to num_paragraph cookie
Bug-28784-Remove-code-related-to-numparagraph-cook.patch (text/plain), 5.06 KB, created by
Tomás Cohen Arazi (tcohen)
on 2021-08-04 22:16:39 UTC
(
hide
)
Description:
Bug 28784: Remove code related to num_paragraph cookie
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2021-08-04 22:16:39 UTC
Size:
5.06 KB
patch
obsolete
>From 0a56606e25575d46dc305aa754362ef0a7cf0c37 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 3 Aug 2021 10:58:47 +0200 >Subject: [PATCH] Bug 28784: Remove code related to num_paragraph cookie > >It could lead to server freeze if set to a big value (we are pushing >into an array and so RAM is being fulfilled, and CPU is looping). > >I don't understand the point of this cookie. > > var numPar = $("#booleansearch fieldset p").size(); > if (numPar > [% search_boxes_count | html %]){ > jQuery.cookie("num_paragraph", numPar,{ path: '/'}); > }else{ > jQuery.removeCookie("num_paragraph", { path: '/'}); > } > >But "#booleansearch fieldset p" does not exist, it's not 'p' but 'div' >elements. > >I've removed the code related to num_paragraph and the "Return to the >last advanced search" feature still works as before. > >From this comment: > # determine what to display next to the search boxes (ie, boolean option > # shouldn't appear on the first one, scan indexes should, adding a new > # box should only appear on the last, etc. > >The only bit that is not working as described is "adding a new box >should only appear on the last", but it has been working this way for >a long time already I think, and I don't see it as a bug. > >Test plan: >Read the code, check that the above is correct. >Search for regression in this "return to last adv search" feature added >by bug 13307. > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > .../bootstrap/en/modules/opac-advsearch.tt | 8 ---- > opac/opac-search.pl | 38 ------------------- > 2 files changed, 46 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index 1edd102340..f5b48f2769 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -482,7 +482,6 @@ $(document).ready(function() { > //Clear all form cookies > jQuery.removeCookie("form_serialized", { path: '/'}); > jQuery.removeCookie("form_serialized_limits", { path: '/'}); >- jQuery.removeCookie("num_paragraph", { path: '/'}); > jQuery.removeCookie("search_path_code", { path: '/'}); > [% END %] > $('#advsearch form').submit(function() { >@@ -508,16 +507,9 @@ $(document).ready(function() { > ]; > jQuery.cookie("form_serialized_limits", form_serialized_limits,{ path: '/'}); > [% IF ( expanded_options ) %] >- var numPar = $("#booleansearch fieldset p").size(); >- if (numPar > [% search_boxes_count | html %]){ >- jQuery.cookie("num_paragraph", numPar,{ path: '/'}); >- }else{ >- jQuery.removeCookie("num_paragraph", { path: '/'}); >- } > jQuery.cookie("search_path_code", 'exs',{ path: '/'}); > [% ELSE %] > jQuery.cookie("search_path_code", 'ads',{ path: '/'}); >- jQuery.removeCookie("num_paragraph", { path: '/'}); > [% END %] > }); > >diff --git a/opac/opac-search.pl b/opac/opac-search.pl >index 67c11c182f..e64b54a236 100755 >--- a/opac/opac-search.pl >+++ b/opac/opac-search.pl >@@ -312,50 +312,12 @@ if ( $template_type && $template_type eq 'advsearch' ) { > $template->param( sort_by => $default_sort_by ); > } > >- # determine what to display next to the search boxes (ie, boolean option >- # shouldn't appear on the first one, scan indexes should, adding a new >- # box should only appear on the last, etc. >- my @search_boxes_array; >- my $search_boxes_count = 3; # begin with 3 boxes >- $template->param( search_boxes_count => $search_boxes_count ); >- >- if ($cgi->cookie("num_paragraph")){ >- $search_boxes_count = $cgi->cookie("num_paragraph"); >- } >- >- for (my $i=1;$i<=$search_boxes_count;$i++) { >- # if it's the first one, don't display boolean option, but show scan indexes >- if ($i==1) { >- push @search_boxes_array, >- { >- scan_index => 1, >- }; >- >- } >- # if it's the last one, show the 'add field' box >- elsif ($i==$search_boxes_count) { >- push @search_boxes_array, >- { >- boolean => 1, >- add_field => 1, >- }; >- } >- else { >- push @search_boxes_array, >- { >- boolean => 1, >- }; >- } >- >- } >- > my @advsearch_limits = split /,/, C4::Context->preference('OpacAdvSearchOptions'); > my @advsearch_more_limits = split /,/, > C4::Context->preference('OpacAdvSearchMoreOptions'); > $template->param( > uc( C4::Context->preference("marcflavour") ) => 1, # we already did this for UNIMARC > advsearch => 1, >- search_boxes_loop => \@search_boxes_array, > OpacAdvSearchOptions => \@advsearch_limits, > OpacAdvSearchMoreOptions => \@advsearch_more_limits, > ); >-- >2.32.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 28784
:
123407
|
123409
|
123412
|
123413
|
123414
|
123416
|
123467
|
123468
|
123558
|
123559
|
123560
|
123561
|
123866
|
123867