From 53db775ecbf8e5e56501a19a8c81ca6e4680d2ab Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 2 Nov 2016 09:19:19 +0000 Subject: [PATCH] Bug 1707: Do not return more than 100 patrons matching the attributes search As you can feel, this patch is not perfect as we are hardcodind the number of results to return. But this number should be correct in the most cases. Test plan: With a large number of patrons, using attributes, you can search for something very generic, like '%'. Without this patch, the MySQL server could be overloaded because of the generated query (built from borrowernumbers). --- C4/Members/Attributes.pm | 3 ++- C4/Utils/DataTables/Members.pm | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/C4/Members/Attributes.pm b/C4/Members/Attributes.pm index ab43a7c..bc69cc4 100644 --- a/C4/Members/Attributes.pm +++ b/C4/Members/Attributes.pm @@ -142,7 +142,7 @@ sub GetBorrowerAttributeValue { =cut sub SearchIdMatchingAttribute{ - my $filter = shift; + my ( $filter, $limit ) = @_; $filter = [$filter] unless ref $filter; my $dbh = C4::Context->dbh(); @@ -152,6 +152,7 @@ FROM borrower_attributes JOIN borrower_attribute_types USING (code) WHERE staff_searchable = 1 AND (} . join (" OR ", map "attribute like ?", @$filter) .qq{)}; + $query .= q{ LIMIT ?} if $limit; my $sth = $dbh->prepare_cached($query); $sth->execute(map "%$_%", @$filter); return [map $_->[0], @{ $sth->fetchall_arrayref }]; diff --git a/C4/Utils/DataTables/Members.pm b/C4/Utils/DataTables/Members.pm index 302eaff..4c8c90f 100644 --- a/C4/Utils/DataTables/Members.pm +++ b/C4/Utils/DataTables/Members.pm @@ -121,7 +121,11 @@ sub search { } if ( $searchfieldstype eq 'standard' and C4::Context->preference('ExtendedPatronAttributes') and $searchmember ) { - my $matching_borrowernumbers = C4::Members::Attributes::SearchIdMatchingAttribute($searchmember); + # 100 is hardcoded here, it could be moved to a pref is necessary + # The borrowernumbers returned by this subroutine will be concatenated to produce another SQL query + # We do not want to generate a very long query as it could overload the server if the user searches + # for something too generic (% for instance) + my $matching_borrowernumbers = C4::Members::Attributes::SearchIdMatchingAttribute($searchmember, 100); for my $borrowernumber ( @$matching_borrowernumbers ) { push @where_strs_or, "borrowers.borrowernumber = ?"; -- 2.9.3