[Bug 40898] New: Add ability to limit the number of columns a patron search api request can sort by
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Bug ID: 40898 Summary: Add ability to limit the number of columns a patron search api request can sort by Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle@bywatersolutions.com Patron API searches can order by any borrowers column and can specify any number of columns to order by as well. Given sufficient numbers of patrons and unindexed columns sort by, the search query generated will create a temp table so large it can fill up the temp disk and prevent the db server from functioning. A reasonable solution would be to create a system preference to set a maximum number of columns to sort by. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42643 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42643 [Bug 42643] [OMNIBUS] Assorted performance and stability work -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |43016 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43016 [Bug 43016] [OMNIBUS] Server resource protection -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|42643 | CC| |andrew@bywatersolutions.com Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42643 [Bug 42643] [OMNIBUS] Assorted performance and stability work -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kyle@bywatersolutions.com |Laura.escamilla@bywatersolu | |tions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zoho.roboto@bywatersolution | |s.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 --- Comment #1 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 208834 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208834&action=edit Bug 40898: Limit Patron REST API sorting columns 1. Apply the patch and run the database update. 2. Navigate to **Administration → System preferences → Web services**. 3. Verify that the new `PatronSearchMaxSortColumns` system preference exists and defaults to `3`. 4. While authenticated in the Koha staff interface, navigate to the following URL to test sorting by three columns: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber` Confirm the request succeeds and returns a JSON array of patrons (HTTP 200). 5. Navigate to the following URL to test sorting by four columns: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber,patron_id` Confirm the request returns HTTP 400 with the following error: `"The maximum number of sorting columns (3) has been exceeded."` 6. Change `PatronSearchMaxSortColumns` to `2` and repeat the three-column request: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber` Confirm the request returns HTTP 400 with the following error: `"The maximum number of sorting columns (2) has been exceeded."` 7. Run the automated tests: `prove -v t/db_dependent/api/v1/patrons.t` Confirm all tests pass with no warnings. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #2 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- With this patch applied I get an error when attempting to search for patrons in the staff client: "400: bad request." Looking at the plack.log, it seems a blank patron search orders by 12 values. The error goes away if I increase the new syspref to 12. We could/should change that, but should probably do so in a distinct bug? 192.168.65.1 - - [23/Oct/2026:19:37:15 +0000] "GET /api/v1/app.pl/api/v1/patrons?_page=1&_per_page=20&_match=contains&_order_by=%2Bme.surname%2C%2Bme.preferred_name%2C%2Bme.firstname%2C%2Bme.middle_name%2C%2Bme.othernames%2C%2Bme.street_number%2C%2Bme.address%2C%2Bme.address2%2C%2Bme.city%2C%2Bme.state%2C%2Bme.postal_code%2C%2Bme.country If we want to keep to the general guideline of "Upgrades don't change behavior by default and new things are optional," then I think we'd want this syspref to set to limit when blank and to be blank at upgrade. As is, it sets to 3 at upgrade and if you set it to blank that gets enforced as if it were set to 0. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org