https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41918 --- Comment #25 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 198273 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198273&action=edit Bug 41918: (QA follow-up) Scope processlist query to the current DB user Koha::Reports->running queries information_schema.processlist. Without the PROCESS privilege MariaDB/MySQL already restrict the view to the caller's own threads, so the previous code worked correctly on stock deployments. However, if a site has granted broader privileges (eg. a shared MariaDB server where the Koha DB user happens to also have PROCESS, or a custom role) the query would happily count threads belonging to other database users - another Koha instance, a reporting tool, or any unrelated application sharing the server. Add an explicit user = SUBSTRING_INDEX(CURRENT_USER(), '@', 1) clause so the query is always scoped to the connection's MySQL user, regardless of what privileges that user has been granted. The processlist.user column holds just the username with no host, so we strip the '@host' off CURRENT_USER() before comparing. The new clause has no bind parameters - it is a constant per connection - so the existing parameterised-bind assertions in the running subtest still hold. A small additional assertion verifies the clause is present in the SQL text. Test plan: 1) prove t/db_dependent/Koha/Reports.t (now 12 tests, all pass). 2) Optional: in a multi-tenant MariaDB, grant PROCESS to the Koha DB user, start a long query as a different DB user with the marker /* { saved_sql.id: 1 } { user_id: 1 } */ in its info, then call Koha::Reports->running. Confirm the foreign thread is NOT counted. -- You are receiving this mail because: You are watching all bug changes.