Page MenuHomePhabricator

MySQL error possible via negative offset and limit on Special:Newpages
Closed, ResolvedPublic

Description

Author: nickpj

Description:
Limit test case:
curl --silent --include --globoff -F 'namespace'='-1' -F 'limit'='-1' -F 'offset'='1' 'http://localhost/wiki/index.php?title=Special:Newpages'

Offset test case:
curl --silent --include --globoff -F 'namespace'='-1' -F 'limit'='1' -F 'offset'='-1' 'http://localhost/wiki/index.php?title=Special:Newpages'

Example test case output, with showing error details enabled:

HTTP/1.1 100 Continue

HTTP/1.1 500 Internal Server Error
Date: Wed, 19 Dec 2007 06:13:57 GMT
Server: Apache
Cache-control: none
Pragma: nocache
Vary: Accept-Encoding,User-Agent
Content-Length: 1141
Connection: close
Content-Type: text/html; charset=utf-8

<html>

<head>
<title>Database error</title>
</head>
<body>
<h1><img src='/wiki/skins/common/images/wiki.png' style='float:left;margin-right:1em' alt=''>Database error</h1>
A database query syntax error has occurred.

This may indicate a bug in the software.
The last attempted database query was:
<blockquote><tt> SELECT 'Newpages' as type,

        rc_namespace AS namespace,
        rc_title AS title,
        rc_cur_id AS cur_id,
        rc_user AS &quot;user&quot;,
        rc_user_text AS user_text,
        rc_comment as &quot;comment&quot;,
        rc_timestamp AS timestamp,
        rc_timestamp AS value,
        '1' as usepatrol,
        rc_patrolled AS patrolled,
        rc_id AS rcid,
        page_len as length,
        page_latest as rev_id
FROM `recentchanges`,`page`
WHERE rc_cur_id=page_id AND rc_new = '1' AND rc_namespace = '-1' AND page_is_redirect = '0' ORDER BY value DESC LIMIT -1,1 </tt></blockquote>

from within function "<tt></tt>".

MySQL returned error "<tt>1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1,1' at line 16 (localhost)</tt>".</body></html>

SVN ref: r28524. Prior to this was using: "list( $limit, $offset ) = wfCheckLimits();", and wfCheckLimits() has a check for negative values. Probably either use this function, or add abs() in appropriate locations.


Version: 1.12.x
Severity: minor

Details

Reference
bz12350

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 9:57 PM
bzimport set Reference to bz12350.
bzimport added a subscriber: Unknown Object (MLST).