[WARN] No method pager found for Koha::Virtualshelves DBIx::Class::ResultSet::pager(): Invalid page number (page-numbers are 1-based) at /usr/share/koha/Koha/Objects.pm line 578 at /usr/share/koha/opac/opac-shelves.pl line 477. L477 my $pager = $shelves->pager; L578 (Objects AUTOLOAD) my $r = eval { $self->_resultset->$method(@params) }; Returns a DBIx::Class::ResultSet::Pager object tied to the current resultset. Requires the page attribute to have been previously set on the resultset object, usually via a call to "page". Looking at our logs, people are sending weird parameters to opac-shelves including non-numeric page numbers in 'page'. Koha should probably not crash on that?
Looks like an attack? Trying to SQL inject something?
When passing non-integer ("x") to page I am getting "A supplied offset attribute must be a non-negative integer"
(In reply to Jonathan Druart from comment #1) > Looks like an attack? Trying to SQL inject something? It does not seem to be a focused SQL injection but looked like a 'TestBuilder' generated URL with random values for known and unknown parameters. But scrolling thru these logs never makes you happy ;)
(In reply to Jonathan Druart from comment #2) > When passing non-integer ("x") to page I am getting "A supplied offset > attribute must be a non-negative integer" Related crash: PLACK-ERROR.LOG Can't call method "last_page" on an undefined value at /usr/share/koha/opac/opac-shelves.pl line 478 DBIx::Class::Storage::DBI::_select_args(): A supplied offset attribute must be a non-negative integer at /usr/share/koha/Koha/Objects.pm line 312
(In reply to Jonathan Druart from comment #2) > When passing non-integer ("x") to page I am getting "A supplied offset > attribute must be a non-negative integer" Yes, cant reproduce this invalid pager crash on master. Note that it comes from a 22.11 log, but that does still not explain it.
Created attachment 166978 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 167002 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com>
Testing notes (using KTD): 1. Go to <opac-url>/cgi-bin/koha/opac-shelves.pl?op=list&public=0&page=X (or got to OPAC > Lists > Your lists, then add &page=x to the URL (no need to log in with an account)) 2. You get an error trace: Can't call method "last_page" on an undefined value at /kohadevbox/koha/opac/opac-shelves.pl line 484 ...... 3.Get an error in the /var/log/koha/kohadev/plack-opac-error.log log file: [2024/05/22 00:33:44] [WARN] Argument "x" isn't numeric in numeric le (<=) at /usr/share/perl5/DBIx/Class/ResultSet.pm line 2523. 2024/05/22 00:33:44] [WARN] No method pager found for Koha::Virtualshelves DBIx::Class::ResultSet::pager(): Invalid page number (page-numbers are 1-based) at /kohadevbox/koha/Koha/Objects.pm line 585 at /kohadevbox/koha/opac/opac-shelves.pl line 483. 4. Apply the patch. 5. Repeat step 1: ==> Warning in plack-opac-error.log: [2024/05/22 00:40:54] [WARN] Argument "x" isn't numeric in int at /kohadevbox/koha/opac/opac-shelves.pl line 90. ==> OPAC result: No error message, stays on the page with Lists (tabs with Your lists + Public lists, and a link to "Log in to create a new list")
Created attachment 167003 [details] [review] Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 167004 [details] [review] Bug 36858: Remove warnings Argument "" isn't numeric in int Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Removed another warning on bug 36914
Pushed for 24.05! Well done everyone, thank you!
Pushed to 23.11.x for 23.11.06
Backported to 23.05.x for upcoming 23.05.12