[Bug 18497] New: Downloading a report passes the constructed SQL as a parameter
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Bug ID: 18497 Summary: Downloading a report passes the constructed SQL as a parameter Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Reports Assignee: gmcharlt@gmail.com Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org This is not ideal, long queries can cause broken links and is a very messy link. report/guided_reports.pl line 816: my $sql = $input->param('sql'); # FIXME: use sql from saved report ID#, not new user-supplied SQL! We use execute_query, so input is sanitized but links look awful http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&format=csv&sql=SELECT%20*%20FROM%20message_queue%20ORDER%20BY%20time_queued%20DESC%0D%0A&reportname=Messages -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Barton Chittenden <barton@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |barton@bywatersolutions.com --- Comment #1 from Barton Chittenden <barton@bywatersolutions.com> --- Created attachment 65338 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=65338&action=edit SQL which generates error -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 --- Comment #2 from Barton Chittenden <barton@bywatersolutions.com> --- Created attachment 65339 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=65339&action=edit Resultant URI -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 --- Comment #3 from Barton Chittenden <barton@bywatersolutions.com> --- A report with a very long query cannot be downloaded as CSV, giving the error 'Request-URI Too Long'. I'm escalating the priority to normal because this is no longer simply a cosmetic issue; it affects the operation of koha itself. See the attached sql and uri files. To replicate: 1) Paste the contents of the attached 'bug-18497-sql.sql' into a report. 2) Save and run the report 3) On the report page, click Download and select 'Comma separated text' 4) The resulting URI is as contained in 'bug-18497-uri.txt' (adjusting for server name), and gives the error message Request-URI Too Long The requested URL's length exceeds the capacity limit for this server. Apache/2.4.10 (Debian) Server at catalog.bywatersolutions.com Port 443 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Barton Chittenden <barton@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|minor |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Chris Slone <cslone@camdencountylibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cslone@camdencountylibrary. | |org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 --- Comment #4 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 70245 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=70245&action=edit Bug 18947 - Use report id to retrieve saved SQL instead of passing param This patch takes some of the code when executing report and moves it to a sub to be reused when downloading To test: 1 - Run some very long report (see comment #1) 2 - Try to download, erk! 3 - Apply patch 4 - Run report, results hould not have changed 5 - Try to download, success! 6 - Ensure reports work as before -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmcharlt@gmail.com |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #5 from Nick Clemens <nick@bywatersolutions.com> --- *** Bug 19803 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |19910 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19910 [Bug 19910] Download report as 'Comma separated' is misleading -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #65338|0 |1 is obsolete| | CC| |mtompset@hotmail.com --- Comment #6 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 70637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=70637&action=edit Sample SQL query to trigger bug. Revised query that works with master and default data -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #70245|0 |1 is obsolete| | --- Comment #7 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 70639 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=70639&action=edit Bug 18497 - Use report id to retrieve saved SQL instead of passing param This patch takes some of the code when executing report and moves it to a sub to be reused when downloading To test: 1 - Run some very long report (see comment #1) 2 - Try to download, erk! 3 - Apply patch 4 - Run report, results hould not have changed 5 - Try to download, success! 6 - Ensure reports work as before https://bugs.koha-community.org/show_bug.cgi?id=18497 Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |julian.maurice@biblibre.com Status|Signed Off |Failed QA --- Comment #8 from Julian Maurice <julian.maurice@biblibre.com> --- This works, but it generates new HTML validation errors:
Error: Bad value /cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&format=csv&report_id=2&reportname=Test↩ &sql_params=foo↩ for attribute href on element a: Tab, new line or carriage return found.
Please fix this. Also, please fix the commit message: - "Bug XXXXX -" should be "Bug XXXXX:" according to https://wiki.koha-community.org/wiki/Commit_messages - Bug's URL should be removed (it's wrong) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #70639|0 |1 is obsolete| | --- Comment #9 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 71060 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71060&action=edit Bug 18497: Use report id to retrieve saved SQL instead of passing param This patch takes some of the code when executing report and moves it to a sub to be reused when downloading To test: 1 - Run some very long report (see comment #1) 2 - Try to download, erk! 3 - Apply patch 4 - Run report, results hould not have changed 5 - Try to download, success! 6 - Ensure reports work as before Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 --- Comment #10 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 71061 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71061&action=edit Bug 18497: (follow-up) Chomp newlines in BLOCK To test: Run report Validate results page at: https://validator.w3.org/ -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #71060|0 |1 is obsolete| | --- Comment #11 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 71080 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71080&action=edit Bug 18497: Use report id to retrieve saved SQL instead of passing param This patch takes some of the code when executing report and moves it to a sub to be reused when downloading To test: 1 - Run some very long report (see comment #1) 2 - Try to download, erk! 3 - Apply patch 4 - Run report, results hould not have changed 5 - Try to download, success! 6 - Ensure reports work as before Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #71061|0 |1 is obsolete| | --- Comment #12 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 71081 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71081&action=edit Bug 18497: (follow-up) Chomp newlines in BLOCK To test: Run report Validate results page at: https://validator.w3.org/ Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 18.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #14 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all, pushed to stable for 17.11.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |claire_gravely@hotmail.com, | |katrin.fischer@bsz-bw.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18497 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20945 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20945 [Bug 20945] Report params not escaped when downloading -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org