Bugzilla – Attachment 64888 Details for
Bug 18854
DoS Offset
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 18854 - Protect from DOS
Bug-18854---Protect-from-DOS.patch (text/plain), 2.02 KB, created by
Julian Maurice
on 2017-07-07 07:59:24 UTC
(
hide
)
Description:
Bug 18854 - Protect from DOS
Filename:
MIME Type:
Creator:
Julian Maurice
Created:
2017-07-07 07:59:24 UTC
Size:
2.02 KB
patch
obsolete
>From 865882d306af4c68fee3429faad0f9841cbe11a5 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chris@bigballofwax.co.nz> >Date: Sun, 25 Jun 2017 17:34:12 +1200 >Subject: [PATCH] Bug 18854 - Protect from DOS > >There was a bug that meant a very large offset in the search params >will cause the search script to run forever (or long enough to crash >the machine) > >To test > >1/ Get ready with sudo top so you can kill the thread before it causes >your machine to OOM >2/ Hit a page like yourdomain.com/cgi-bin/koha/opac-search.pl?q=1&offset=-9999999999999999999 >3/ Notice the process runs for a long time >4/ Kill the process >5/ Apply the patch >6/ Hit the page again, notice the it loads (offset is set to zero) >7/ Do the same to search in the staff client > >Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Amended: changed -2 to 0 in opac-search.pl. >Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> >--- > catalogue/search.pl | 1 + > opac/opac-search.pl | 1 + > 2 files changed, 2 insertions(+) > >diff --git a/catalogue/search.pl b/catalogue/search.pl >index 8488f832a0..72bb5ec9d4 100755 >--- a/catalogue/search.pl >+++ b/catalogue/search.pl >@@ -449,6 +449,7 @@ my $scan = $params->{'scan'}; > my $count = C4::Context->preference('numSearchResults') || 20; > my $results_per_page = $params->{'count'} || $count; > my $offset = $params->{'offset'} || 0; >+$offset = 0 if $offset < 0; > my $page = $cgi->param('page') || 1; > #my $offset = ($page-1)*$results_per_page; > my $hits; >diff --git a/opac/opac-search.pl b/opac/opac-search.pl >index 76b24f3fc7..145673230d 100755 >--- a/opac/opac-search.pl >+++ b/opac/opac-search.pl >@@ -521,6 +521,7 @@ my $count = C4::Context->preference('OPACnumSearchResults') || 20; > my $countRSS = C4::Context->preference('numSearchRSSResults') || 50; > my $results_per_page = $params->{'count'} || $count; > my $offset = $params->{'offset'} || 0; >+$offset = 0 if $offset < 0; > my $page = $cgi->param('page') || 1; > $offset = ($page-1)*$results_per_page if $page>1; > my $hits; >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 18854
:
64611
|
64612
|
64617
|
64799
|
64800
| 64888 |
64889
|
64969
|
65039
|
65040