Summary: | Crash on wrong page number in opac-shelves | ||
---|---|---|---|
Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
Component: | Architecture, internals, and plumbing | Assignee: | Marcel de Rooy <m.de.rooy> |
Status: | Pushed to oldstable --- | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P5 - low | CC: | david, fridolin.somers, jonathan.druart, lucas |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36914 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37285 |
||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
24.05.00,23.11.06,24.05.12
|
|
Circulation function: | |||
Attachments: |
Bug 36858: Check page parameter for virtual shelves
Bug 36858: Check page parameter for virtual shelves Bug 36858: Check page parameter for virtual shelves Bug 36858: Remove warnings |
Description
Marcel de Rooy
2024-05-14 12:01:10 UTC
Looks like an attack? Trying to SQL inject something? When passing non-integer ("x") to page I am getting "A supplied offset attribute must be a non-negative integer" (In reply to Jonathan Druart from comment #1) > Looks like an attack? Trying to SQL inject something? It does not seem to be a focused SQL injection but looked like a 'TestBuilder' generated URL with random values for known and unknown parameters. But scrolling thru these logs never makes you happy ;) (In reply to Jonathan Druart from comment #2) > When passing non-integer ("x") to page I am getting "A supplied offset > attribute must be a non-negative integer" Related crash: PLACK-ERROR.LOG Can't call method "last_page" on an undefined value at /usr/share/koha/opac/opac-shelves.pl line 478 DBIx::Class::Storage::DBI::_select_args(): A supplied offset attribute must be a non-negative integer at /usr/share/koha/Koha/Objects.pm line 312 (In reply to Jonathan Druart from comment #2) > When passing non-integer ("x") to page I am getting "A supplied offset > attribute must be a non-negative integer" Yes, cant reproduce this invalid pager crash on master. Note that it comes from a 22.11 log, but that does still not explain it. Created attachment 166978 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 167002 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Testing notes (using KTD): 1. Go to <opac-url>/cgi-bin/koha/opac-shelves.pl?op=list&public=0&page=X (or got to OPAC > Lists > Your lists, then add &page=x to the URL (no need to log in with an account)) 2. You get an error trace: Can't call method "last_page" on an undefined value at /kohadevbox/koha/opac/opac-shelves.pl line 484 ...... 3.Get an error in the /var/log/koha/kohadev/plack-opac-error.log log file: [2024/05/22 00:33:44] [WARN] Argument "x" isn't numeric in numeric le (<=) at /usr/share/perl5/DBIx/Class/ResultSet.pm line 2523. 2024/05/22 00:33:44] [WARN] No method pager found for Koha::Virtualshelves DBIx::Class::ResultSet::pager(): Invalid page number (page-numbers are 1-based) at /kohadevbox/koha/Koha/Objects.pm line 585 at /kohadevbox/koha/opac/opac-shelves.pl line 483. 4. Apply the patch. 5. Repeat step 1: ==> Warning in plack-opac-error.log: [2024/05/22 00:40:54] [WARN] Argument "x" isn't numeric in int at /kohadevbox/koha/opac/opac-shelves.pl line 90. ==> OPAC result: No error message, stays on the page with Lists (tabs with Your lists + Public lists, and a link to "Log in to create a new list") Created attachment 167003 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Created attachment 167004 [details] [review] Bug 36858: Remove warnings Argument "" isn't numeric in int Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Removed another warning on bug 36914 Pushed for 24.05! Well done everyone, thank you! Pushed to 23.11.x for 23.11.06 Backported to 23.05.x for upcoming 23.05.12 |