[Bug 36034] New: cas_ticket is set to serialized patron object in session
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Bug ID: 36034 Summary: cas_ticket is set to serialized patron object in session Change sponsored?: --- Product: Koha Version: 23.05 Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: andreas.jonsson@kreablo.se QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org The fix for bug 34893 alters the return value type of checkpw, but does not adequately update the code everywhere where this is used. In particular, with shibboleth enabled the cas_ticket is sent to a patron object which gets serialized into the user session which quickly consumes a large amount of disk space on a busy system. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Andreas Jonsson <andreas.jonsson@kreablo.se> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=34893 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #1 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- Created attachment 161888 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=161888&action=edit Bug 36034: fix capture of return values from checkpw Adapt code to the change of return value type of checkpw introduced in bug 34893 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #2 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- The disk space problem happens with binary logging enabled and using mysql as session storage. Also, it seems to happen both with and without shibboleth enabled. I have been running 23.05.08 for less than 2 days and are already seeing a large increase in disk space on several servers. I have emergency patched my servers and I suspect that many libraries are going to run into problems with disk space in the coming weeks. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Andreas Jonsson <andreas.jonsson@kreablo.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P1 - high -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com --- Comment #3 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Andreas Jonsson from comment #2)
The disk space problem happens with binary logging enabled and using mysql as session storage.
Also, it seems to happen both with and without shibboleth enabled.
I have been running 23.05.08 for less than 2 days and are already seeing a large increase in disk space on several servers.
I have emergency patched my servers and I suspect that many libraries are going to run into problems with disk space in the coming weeks.
Is this patch ready for sign-off? That status is still NEW. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #4 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- It is complex code. I'll let someone else be the judge if it is ready for signoff. I have no good idea for test plan other than inspecting the binary logs of the database. But I would say that it is urgent. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #5 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- Also I am already running this patch live on several servers. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34893 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893 [Bug 34893] ILS-DI can return the wrong patron for AuthenticatePatron -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #161888|0 |1 is obsolete| | --- Comment #6 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 161926 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=161926&action=edit Bug 36034: fix capture of return values from checkpw Adapt code to the change of return value type of checkpw introduced in bug 34893 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #7 from Kyle M Hall <kyle@bywatersolutions.com> --- Changes seem clearly correct, all unit tests are passing. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com, mtj@kohaaloha.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #161926|0 |1 is obsolete| | --- Comment #8 from David Cook <dcook@prosentient.com.au> --- Created attachment 162130 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162130&action=edit Bug 36034: fix capture of return values from checkpw Adapt code to the change of return value type of checkpw introduced in bug 34893 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | CC| |dcook@prosentient.com.au Assignee|koha-bugs@lists.koha-commun |andreas.jonsson@kreablo.se |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- As Kyle said, code review shows the fix clearly. You can also see the difference in the "sessions" table after a logging both before and after applying the patch. After applying the patch, the session data looks correct and isn't full of serialized data from a Koha::Patron object. QA tools are happy. This one is a ticking timebomb for anyone running one of the versions that contains bug 34893, so I think releasing this ASAP would be wise. I don't know how to reproduce the "Too many nested open parens in regex;" error thrown by YAML::XS::__qr_loader, but I imagine it's happening to people in the wild as it's been happening to us in dev. Good job on reporting and fixing this one, Andreas. I didn't notice it in my emails until I sent that listserv email where you commented. Not sure what happened there... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162130|0 |1 is obsolete| | --- Comment #10 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 162131 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162131&action=edit Bug 36034: (bug 34893 follow-up) fix capture of return values from checkpw Adapt code to the change of return value type of checkpw introduced in bug 34893 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 --- Comment #11 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 162132 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162132&action=edit Bug 36034: Add test Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|23.05 |master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to master for 24.05.00. I did an inline tidy of the block added to unit tests to make the QA script happy. Thanks Jonathan. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.00 |24.05.00,23.11.03 released in| | CC| |fridolin.somers@biblibre.co | |m Patch complexity|--- |Trivial patch Status|Pushed to master |Pushed to stable --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.00,23.11.03 |24.05.00,23.11.03,23.05.09 released in| | Status|Pushed to stable |Pushed to oldstable --- Comment #14 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 23.05.x for upcoming 23.05.09 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |frederic@tamil.fr --- Comment #15 from Frédéric Demians <frederic@tamil.fr> --- Backported 22.11.15 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162132|0 |1 is obsolete| | --- Comment #16 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 162529 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162529&action=edit Bug 36034: [22.05] Add test Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.00,23.11.03,23.05.09 |24.05.00,23.11.03,23.05.09, released in| |22.11.15,22.05.19 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.renvoize@ptfs-europe | |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Bug 36034 depends on bug 34893, which changed state. Bug 34893 Summary: ILS-DI can return the wrong patron for AuthenticatePatron https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org