Bug #15922
closedTask search not properly validating input, throws SQL error
Description
Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1248271
Description of problem:
Depending on expected inputs, user can get a SQL error thrown on Tasks when providing wrong input type.
Steps to Reproduce:
1. Create admin user named 'mmccune'
2. Using 'mmccune', perform a variety of tasks.
3. Monitor > Tasks
4. in search filter, search for owner.id = mmccune (note that this is incorrect; id is expecting an integer)
Actual results:
PGError: ERROR: invalid input syntax for integer: "mmccune" LINE 4: ...) WHERE ((foreman_tasks_locks_owner.resource_id = 'mmccune')... ^ : SELECT "foreman_tasks_tasks".* FROM "foreman_tasks_tasks" INNER JOIN foreman_tasks_locks AS foreman_tasks_locks_owner ON (foreman_tasks_locks_owner.task_id = foreman_tasks_tasks.id AND foreman_tasks_locks_owner.resource_type = 'User' AND foreman_tasks_locks_owner.name = 'task_owner') WHERE ((foreman_tasks_locks_owner.resource_id = 'mmccune')) ORDER BY "foreman_tasks_tasks"."started_at" DESC NULLS LAST LIMIT 20 OFFSET 0
Expected results:
Proper handling of incorrect inputs.
Updated by Ivan Necas over 8 years ago
- Subject changed from Task search not properly validating input, throws SQL error to Task search not properly validating input, throws SQL error
- Target version set to 1.7.0
Updated by Ivan Necas over 8 years ago
- Target version changed from 1.7.0 to 1.6.1
Updated by Shimon Shtein over 8 years ago
Added an issue in scoped_search with a suggestion to solve: https://github.com/wvanbergen/scoped_search/issues/148
Updated by Ivan Necas over 8 years ago
- Status changed from New to Ready For Testing
- Assignee changed from Ivan Necas to Shimon Shtein
Updated by Ivan Necas over 8 years ago
- Pull request https://github.com/wvanbergen/scoped_search/pull/149 added
Updated by Shimon Shtein over 8 years ago
We will need an extra step after scoped_search PR will be merged. We will need to actually add a proper validator to owner.id field.
Updated by Ivan Necas about 8 years ago
- Target version changed from 1.5.1 to 1.4.1
Updated by The Foreman Bot about 8 years ago
- Pull request https://github.com/theforeman/foreman-tasks/pull/212 added
Updated by Ivan Necas about 8 years ago
- Target version changed from 1.4.1 to 113
Updated by Shimon Shtein about 8 years ago
- Blocked by Refactor #17574: Update to scoped_search 4.x added
Updated by Shimon Shtein almost 8 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset 4948e997eac2e4cde0628e73561b8198f48f6cd6.
Updated by Ivan Necas almost 8 years ago
- Target version changed from 113 to 1.12.2