https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41918 --- Comment #21 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 198263 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198263&action=edit Bug 41918: (QA follow-up) Enforce duplicate-running limit in the model The previous patches enforced duplicate_running_reports_per_user_limit only in reports/guided_reports.pl. Two other code paths run saved SQL reports for an authenticated user and bypassed the guard entirely: - svc/report (staff JSON endpoint, eg. used for chart widgets and any caller hitting /cgi-bin/koha/svc/report?id=N directly) - opac/svc/report (OPAC JSON endpoint) A user who hit their staff-UI limit could still spawn additional copies of the same long-running report via either svc endpoint, defeating the guard. Push the check into Koha::Report::prep_report itself, which is the one function all three callers go through. When the limit is reached prep_report now throws a new Koha::Exceptions::Report::DuplicateRunning (carrying report_id, user_id and the configured limit). The guided reports CGI catches it and re-renders the existing "report is already running" alert; both svc/report endpoints catch it and return HTTP 429 Too Many Requests with a JSON { error: "duplicate_running_report" } payload. Notes: - The pre-flight Koha::Reports->running call is removed from the guided-reports CGI; the model now owns that policy and the controller is just rendering. The TOCTOU window remains identical in size and is the same intentional trade-off as before. - Limit=0 (the default) and absent userenv both bypass the check, so CLI cronjobs (misc/cronjobs/runreport.pl) and direct DB users are unaffected. Test plan: 1) prove t/db_dependent/Koha/Reports.t - now includes a new subtest covering limit=0 (lives), under limit (lives) and at limit (throws Koha::Exceptions::Report::DuplicateRunning). 2) Set duplicate_running_reports_per_user_limit=1 in koha-conf.xml, restart_all. 3) Open a long-running report in two staff tabs - second tab shows the "report is already running" alert (unchanged behaviour). 4) While one run is in flight, hit /cgi-bin/koha/svc/report?id=N as the same user - now returns HTTP 429 with the JSON error payload (previously: ran a second copy of the query). 5) Same check on /cgi-bin/koha/opac/svc/report?id=N. -- You are receiving this mail because: You are watching all bug changes.