[Bug 36858] New: Crash on wrong page number in opac-shelves
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Bug ID: 36858 Summary: Crash on wrong page number in opac-shelves Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org [WARN] No method pager found for Koha::Virtualshelves DBIx::Class::ResultSet::pager(): Invalid page number (page-numbers are 1-based) at /usr/share/koha/Koha/Objects.pm line 578 at /usr/share/koha/opac/opac-shelves.pl line 477. L477 my $pager = $shelves->pager; L578 (Objects AUTOLOAD) my $r = eval { $self->_resultset->$method(@params) }; Returns a DBIx::Class::ResultSet::Pager object tied to the current resultset. Requires the page attribute to have been previously set on the resultset object, usually via a call to "page". Looking at our logs, people are sending weird parameters to opac-shelves including non-numeric page numbers in 'page'. Koha should probably not crash on that? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #1 from Jonathan Druart <jonathan.druart@gmail.com> --- Looks like an attack? Trying to SQL inject something? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- When passing non-integer ("x") to page I am getting "A supplied offset attribute must be a non-negative integer" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #1)
Looks like an attack? Trying to SQL inject something?
It does not seem to be a focused SQL injection but looked like a 'TestBuilder' generated URL with random values for known and unknown parameters. But scrolling thru these logs never makes you happy ;) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #2)
When passing non-integer ("x") to page I am getting "A supplied offset attribute must be a non-negative integer"
Related crash: PLACK-ERROR.LOG Can't call method "last_page" on an undefined value at /usr/share/koha/opac/opac-shelves.pl line 478 DBIx::Class::Storage::DBI::_select_args(): A supplied offset attribute must be a non-negative integer at /usr/share/koha/Koha/Objects.pm line 312 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #5 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #2)
When passing non-integer ("x") to page I am getting "A supplied offset attribute must be a non-negative integer"
Yes, cant reproduce this invalid pager crash on master. Note that it comes from a 22.11 log, but that does still not explain it. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 166978 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=166978&action=edit Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #166978|0 |1 is obsolete| | --- Comment #7 from David Nind <david@davidnind.com> --- Created attachment 167002 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167002&action=edit Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #8 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. Go to <opac-url>/cgi-bin/koha/opac-shelves.pl?op=list&public=0&page=X (or got to OPAC > Lists > Your lists, then add &page=x to the URL (no need to log in with an account)) 2. You get an error trace: Can't call method "last_page" on an undefined value at /kohadevbox/koha/opac/opac-shelves.pl line 484 ...... 3.Get an error in the /var/log/koha/kohadev/plack-opac-error.log log file: [2024/05/22 00:33:44] [WARN] Argument "x" isn't numeric in numeric le (<=) at /usr/share/perl5/DBIx/Class/ResultSet.pm line 2523. 2024/05/22 00:33:44] [WARN] No method pager found for Koha::Virtualshelves DBIx::Class::ResultSet::pager(): Invalid page number (page-numbers are 1-based) at /kohadevbox/koha/Koha/Objects.pm line 585 at /kohadevbox/koha/opac/opac-shelves.pl line 483. 4. Apply the patch. 5. Repeat step 1: ==> Warning in plack-opac-error.log: [2024/05/22 00:40:54] [WARN] Argument "x" isn't numeric in int at /kohadevbox/koha/opac/opac-shelves.pl line 90. ==> OPAC result: No error message, stays on the page with Lists (tabs with Your lists + Public lists, and a link to "Log in to create a new list") -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167002|0 |1 is obsolete| | --- Comment #9 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 167003 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167003&action=edit Bug 36858: Check page parameter for virtual shelves Test plan: Try passing page=x now and verify different behavior (no 500). Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #10 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 167004 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167004&action=edit Bug 36858: Remove warnings Argument "" isn't numeric in int Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36914 --- Comment #11 from Jonathan Druart <jonathan.druart@gmail.com> --- Removed another warning on bug 36914 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Version(s)|24.05.00 |24.05.00,23.11.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable CC| |lucas@bywatersolutions.com Version(s)|24.05.00,23.11.06 |24.05.00,23.11.06,24.05.12 released in| | --- Comment #14 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 23.05.x for upcoming 23.05.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37285 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36858 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED --- Comment #15 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org