Bugzilla – Attachment 64612 Details for
Bug 18854
DoS Offset
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 18854 - Protect from DOS
Bug-18854---Protect-from-DOS.patch (text/plain), 1.85 KB, created by
Mirko Tietgen
on 2017-06-25 08:22:40 UTC
(
hide
)
Description:
Bug 18854 - Protect from DOS
Filename:
MIME Type:
Creator:
Mirko Tietgen
Created:
2017-06-25 08:22:40 UTC
Size:
1.85 KB
patch
obsolete
>From 74681f6249846417ce113ff96a74d802847e7463 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chris@bigballofwax.co.nz> >Date: Sun, 25 Jun 2017 17:34:12 +1200 >Subject: [PATCH] Bug 18854 - Protect from DOS > >There was a bug that meant a very large offset in the search params >will cause the search script to run forever (or long enough to crash >the machine) > >To test > >1/ Get ready with sudo top so you can kill the thread before it causes >your machine to OOM >2/ Hit a page like yourdomain.com/cgi-bin/koha/opac-search.pl?q=1&offset=-9999999999999999999 >3/ Notice the process runs for a long time >4/ Kill the process >5/ Apply the patch >6/ Hit the page again, notice the it loads (offset is set to zero) >7/ Do the same to search in the staff client > >Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net> >--- > catalogue/search.pl | 1 + > opac/opac-search.pl | 1 + > 2 files changed, 2 insertions(+) > >diff --git a/catalogue/search.pl b/catalogue/search.pl >index 8488f83..72bb5ec 100755 >--- a/catalogue/search.pl >+++ b/catalogue/search.pl >@@ -449,6 +449,7 @@ my $scan = $params->{'scan'}; > my $count = C4::Context->preference('numSearchResults') || 20; > my $results_per_page = $params->{'count'} || $count; > my $offset = $params->{'offset'} || 0; >+$offset = 0 if $offset < 0; > my $page = $cgi->param('page') || 1; > #my $offset = ($page-1)*$results_per_page; > my $hits; >diff --git a/opac/opac-search.pl b/opac/opac-search.pl >index 7b10ac3..dccba3f 100755 >--- a/opac/opac-search.pl >+++ b/opac/opac-search.pl >@@ -520,6 +520,7 @@ my $count = C4::Context->preference('OPACnumSearchResults') || 20; > my $countRSS = C4::Context->preference('numSearchRSSResults') || 50; > my $results_per_page = $params->{'count'} || $count; > my $offset = $params->{'offset'} || 0; >+$offset = -2 if $offset < 0; > my $page = $cgi->param('page') || 1; > $offset = ($page-1)*$results_per_page if $page>1; > my $hits; >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 18854
:
64611
|
64612
|
64617
|
64799
|
64800
|
64888
|
64889
|
64969
|
65039
|
65040