Cannot delete File:MKC,S.jpg on zhwiki due to DBQueryError
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	Shizhao
	Sep 18 2017, 12:53 AM

Description

on zhwiki delete image ( via url https://zh.wikipedia.org/w/index.php?title=File:MKC,S.jpg&action=delete&autotrigger_element=%23wpConfirmB%2C%23mw-filedelete-submit&wpReason=%5B%5BWP%3ACSD%23F6%7CF6%5D%5D%3A+%E6%B2%92%E6%9C%89%E8%A2%AB%E6%A2%9D%E7%9B%AE%E4%BD%BF%E7%94%A8%E7%9A%84%5B%5BWP%3A%E5%90%88%E7%90%86%E4%BD%BF%E7%94%A8%7C%E9%9D%9E%E8%87%AA%E7%94%B1%E7%89%88%E6%9D%83%5D%5D%E6%AA%94%E6%A1%88%E4%BC%9A%E5%9C%A8%E6%8F%90%E4%BA%A45%E6%97%A5%E5%90%8E%E5%88%AA%E9%99%A4%EF%BC%9B%2A%3C%2Fstrong%3E%E8%87%B4%E7%AE%A1%E7%90%86%E5%91%98%EF%BC%9A%E6%A0%B9%E6%8D%AE%5B%5BWikipedia%3A%E9%9D%9E%E8%87%AA%E7%94%B1%E5%86%85%E5%AE%B9%E4%BD%BF%E7%94%A8%E5%87%86%E5%88%99%7C%E9%9D%9E%E8%87%AA%E7%94%B1%E5%86%85%E5%AE%B9%E4%BD%BF%E7%94%A8%E5%87%86%E5%88%99%5D%5D%EF%BC%8C%E8%AF%B7%E4%BA%8E%27%27%272017%E5%B9%B49%E6%9C%8818%E6%97%A5%27%27%27%E5%90%8E%E5%88%A0%E9%99%A4%E6%9C%AC%E6%96%87%E4%BB%B6%E3%80%82 ), return a database error

2017-09-18 00:43:34 [Wb8WtgpAEKkAAHa3o@0AAABD] mw1214 zhwiki 1.30.0-wmf.18 exception ERROR: [Wb8WtgpAEKkAAHa3o@0AAABD] /w/index.php?title=File:S1940316.jpg&action=delete   Wikimedia\Rdbms\DBQueryError from line 1149 of /srv/mediawiki/php-1.30.0-wmf.18/includes/libs/rdbms/database/Database.php: A database query error has occurred. Did you forget to run your application's database schema updater after upgrading? 
Query: SELECT  'deleted' AS `fa_storage_group`, (CASE WHEN img_sha1 = '' THEN '' ELSE CONCAT(img_sha1,'.jpg') END)  AS `fa_storage_key`,'138' AS `fa_deleted_user`,'20170918004334' AS `fa_deleted_timestamp`,0 AS `fa_deleted`,img_name AS `fa_name`,NULL AS `fa_archive_name`,img_size AS `fa_size`,img_width AS `fa_width`,img_height AS `fa_height`,img_metadata AS `fa_metadata`,img_bits AS `fa_bits`,img_media_type AS `fa_media_type`,img_major_mime AS `fa_major_mime`,img_minor_mime AS `fa_minor_mime`,img_user AS `fa_user`,img_user_text AS `fa_user_text`,img_timestamp AS `fa_timestamp`,img_sha1 AS `fa_sha1`,'[[WP:CSD#F6|F6]]: 沒有被條目使用的[[WP:合理使用|非自由版权]]檔案会在提交5日后刪除；*</strong>致管理员：根据[[Wikipedia:非自由内容使用准则|非自由内容使用准则]]，请于\'\'\'2017年9月18日\'\'\'后… AS `fa_deleted_reason`,img_description AS `fa_description`  FROM `image`    WHERE img_name = 'S1940316.jpg'   FOR UPDATE
Function: LocalFileDeleteBatch::doDBInserts
Error: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '.jpg'   FOR UPDATE' at line 1 (10.64.0.206)
 {"exception_id":"Wb8WtgpAEKkAAHa3o@0AAABD","exception_url":"/w/index.php?title=File:S1940316.jpg&action=delete","caught_by":"mwe_handler"} 
[Exception Wikimedia\Rdbms\DBQueryError] (/srv/mediawiki/php-1.30.0-wmf.18/includes/libs/rdbms/database/Database.php:1149) A database query error has occurred. Did you forget to run your application's database schema updater after upgrading? 
Query: SELECT  'deleted' AS `fa_storage_group`, (CASE WHEN img_sha1 = '' THEN '' ELSE CONCAT(img_sha1,'.jpg') END)  AS `fa_storage_key`,'138' AS `fa_deleted_user`,'20170918004334' AS `fa_deleted_timestamp`,0 AS `fa_deleted`,img_name AS `fa_name`,NULL AS `fa_archive_name`,img_size AS `fa_size`,img_width AS `fa_width`,img_height AS `fa_height`,img_metadata AS `fa_metadata`,img_bits AS `fa_bits`,img_media_type AS `fa_media_type`,img_major_mime AS `fa_major_mime`,img_minor_mime AS `fa_minor_mime`,img_user AS `fa_user`,img_user_text AS `fa_user_text`,img_timestamp AS `fa_timestamp`,img_sha1 AS `fa_sha1`,'[[WP:CSD#F6|F6]]: 沒有被條目使用的[[WP:合理使用|非自由版权]]檔案会在提交5日后刪除；*</strong>致管理员：根据[[Wikipedia:非自由内容使用准则|非自由内容使用准则]]，请于\'\'\'2017年9月18日\'\'\'后… AS `fa_deleted_reason`,img_description AS `fa_description`  FROM `image`    WHERE img_name = 'S1940316.jpg'   FOR UPDATE
Function: LocalFileDeleteBatch::doDBInserts
Error: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '.jpg'   FOR UPDATE' at line 1 (10.64.0.206)

  #0 /srv/mediawiki/php-1.30.0-wmf.18/includes/libs/rdbms/database/Database.php(979): Wikimedia\Rdbms\Database->reportQueryError(string, integer, string, string, boolean)
  #1 /srv/mediawiki/php-1.30.0-wmf.18/includes/libs/rdbms/database/Database.php(1343): Wikimedia\Rdbms\Database->query(string, string)
  #2 /srv/mediawiki/php-1.30.0-wmf.18/includes/libs/rdbms/database/Database.php(2402): Wikimedia\Rdbms\Database->select(array, string, array, string, array, array)
  #3 /srv/mediawiki/php-1.30.0-wmf.18/includes/filerepo/file/LocalFile.php(2389): Wikimedia\Rdbms\Database->insertSelect(string, array, array, array, string, array, array, array)
  #4 /srv/mediawiki/php-1.30.0-wmf.18/includes/filerepo/file/LocalFile.php(2515): LocalFileDeleteBatch->doDBInserts()
  #5 /srv/mediawiki/php-1.30.0-wmf.18/includes/filerepo/file/LocalFile.php(1813): LocalFileDeleteBatch->execute()
  #6 /srv/mediawiki/php-1.30.0-wmf.18/includes/FileDeleteForm.php(201): LocalFile->delete(string, boolean, User)
  #7 /srv/mediawiki/php-1.30.0-wmf.18/includes/FileDeleteForm.php(119): FileDeleteForm::doDelete(Title, LocalFile, string, string, boolean, User)
  #8 /srv/mediawiki/php-1.30.0-wmf.18/includes/page/ImagePage.php(985): FileDeleteForm->execute()
  #9 /srv/mediawiki/php-1.30.0-wmf.18/includes/actions/DeleteAction.php(46): ImagePage->delete()
  #10 /srv/mediawiki/php-1.30.0-wmf.18/includes/MediaWiki.php(499): DeleteAction->show()
  #11 /srv/mediawiki/php-1.30.0-wmf.18/includes/MediaWiki.php(293): MediaWiki->performAction(ImagePage, Title)
  #12 /srv/mediawiki/php-1.30.0-wmf.18/includes/MediaWiki.php(848): MediaWiki->performRequest()
  #13 /srv/mediawiki/php-1.30.0-wmf.18/includes/MediaWiki.php(523): MediaWiki->main()
  #14 /srv/mediawiki/php-1.30.0-wmf.18/index.php(43): MediaWiki->run()
  #15 /srv/mediawiki/w/index.php(3): include(string)
  #16 {main}

Related Objects

Mentioned In: T176185: Unable to delete file on Commons (Fatal exception of type "Wikimedia\Rdbms\DBQueryError")

Event Timeline

Shizhao created this task.Sep 18 2017, 12:53 AM

Restricted Application added subscribers: Stang, Aklapper. · View Herald TranscriptSep 18 2017, 12:53 AM

Shizhao updated the task description. (Show Details)Sep 18 2017, 12:57 AM

Xiplus subscribed.Sep 18 2017, 1:00 AM

zhuyifei1999 renamed this task from image can't delete to Cannot delete File:MKC,S.jpg on zhwiki due to DBQueryError.Sep 18 2017, 4:03 AM

zhuyifei1999 added a project: DBA.

zhuyifei1999 added a project: Wikimedia-production-error.

zhuyifei1999 subscribed.

@Shizhao: Please post text as text so it can be searched for. Please do not post text as images. Thanks.

In T176101#3614076, @Aklapper wrote:

@Shizhao: Please post text as text so it can be searched for. Please do not post text as images. Thanks.

Just FYI:

数据库错误 is Databaseerror
出现数据库查询错误。这可能表示软件中存在漏洞。 is Databaseerror-text
Text in red box ([Wb8WtgpAEKkAAHa3o@0AAABD] 2017-09-18 00:43:44: 类型“Wikimedia\Rdbms\DBQueryError”的致命错误) is derived from Internalerror-fatal-exception

aaron added a project: acl*security.Sep 18 2017, 9:10 AM

aaron changed the visibility from "Public (No Login Required)" to "acl*security (Project)".

Problem seems to be:

if ( $this->stage <= MIGRATION_WRITE_BOTH ) {
	$fields[$this->key] = $this->lang->truncate( $comment->text, 255 );
}

...LocalFile already used addQuotes(), and this can remove the ending quote character.

tstarling assigned this task to Anomie.Sep 18 2017, 12:01 PM

Bawolff added a project: Vuln-Inject.Sep 18 2017, 12:57 PM

Bawolff removed a project: DBA.

In T176101#3614184, @aaron wrote:
Problem seems to be:
if ( $this->stage <= MIGRATION_WRITE_BOTH ) {
	$fields[$this->key] = $this->lang->truncate( $comment->text, 255 );
}
...LocalFile already used addQuotes(), and this can remove the ending quote character.

That's not the real problem. The problem is that the different behavior of IDatabase->insertSelect()'s $varMap versus ->insert()'s $a wasn't noticed, so the code was incorrectly quoting the value passed to CommentStore->insert() (from the original pre-CommentStore code) rather than quoting the returned literal fields for passing into IDatabase->insertSelect().

0001-SECURITY-Fix-handling-of-CommentStore-and-insertSele.patch1 KBDownload

Reedy merged a task: T176185: Unable to delete file on Commons (Fatal exception of type "Wikimedia\Rdbms\DBQueryError").Sep 18 2017, 10:56 PM

Reedy updated the task description. (Show Details)

Reedy added a subscriber: Josve05a.

Reedy mentioned this in T176185: Unable to delete file on Commons (Fatal exception of type "Wikimedia\Rdbms\DBQueryError").Sep 18 2017, 11:06 PM

Reedy changed the visibility from "acl*security (Project)" to "Custom Policy".Sep 18 2017, 11:14 PM

@aaron Just an FYI, in future, use the "Protect as security issue" on the right hand side to make an open non security bug into a security one. Otherwise, the correct visibility isn't applied

~~Is T176185 related? /me don't have access...~~

Edit: Never mind, I found it closed as a duplicate of this one.

In T176101#3614778, @Anomie wrote:
In T176101#3614184, @aaron wrote:
Problem seems to be:
if ( $this->stage <= MIGRATION_WRITE_BOTH ) {
	$fields[$this->key] = $this->lang->truncate( $comment->text, 255 );
}
...LocalFile already used addQuotes(), and this can remove the ending quote character.
That's not the real problem. The problem is that the different behavior of IDatabase->insertSelect()'s $varMap versus ->insert()'s $a wasn't noticed, so the code was incorrectly quoting the value passed to CommentStore->insert() (from the original pre-CommentStore code) rather than quoting the returned literal fields for passing into IDatabase->insertSelect().

0001-SECURITY-Fix-handling-of-CommentStore-and-insertSele.patch1 KBDownload

Well, I'd say both together at least. I merely mentioned that line since it's were the escaping breaks, not since it's necessarily incorrect itself.

Applied that patch in https://gerrit.wikimedia.org/r/#/c/378818/ , deployed.

Liuxinyu970226 unsubscribed.Sep 19 2017, 12:10 PM

Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Sep 19 2017, 5:03 PM

Restricted Application added subscribers: Jay8g, TerraCodes. · View Herald TranscriptSep 19 2017, 5:03 PM

Shizhao moved this task from Backlog to Closed on the Chinese-Sites board.Sep 21 2017, 2:48 AM

Amorymeltzer subscribed.May 2 2019, 11:00 AM

• mmodell changed the subtype of this task from "Task" to "Production Error".Aug 28 2019, 11:09 PM

Zabe removed a project: Patch-For-Review.Jul 29 2021, 12:20 PM

Stang unsubscribed.Nov 1 2021, 7:02 PM

	F9624809: 0001-SECURITY-Fix-handling-of-CommentStore-and-insertSele.patch
	Sep 18 2017, 2:17 PM

Cannot delete File:MKC,S.jpg on zhwiki due to DBQueryErrorClosed, ResolvedPublicPRODUCTION ERRORActions

Description

Related Objects

Event Timeline

Cannot delete File:MKC,S.jpg on zhwiki due to DBQueryError
Closed, ResolvedPublicPRODUCTION ERROR
Actions