Last modified: 2007-12-22 20:20:15 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T14350, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 12350 - MySQL error possible via negative offset and limit on Special:Newpages
MySQL error possible via negative offset and limit on Special:Newpages
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
Special pages (Other open bugs)
1.12.x
All All
: Low minor (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-19 06:19 UTC by Nick Jenkins
Modified: 2007-12-22 20:20 UTC (History)
1 user (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Nick Jenkins 2007-12-19 06:19:08 UTC
Limit test case:
curl --silent --include --globoff -F 'namespace'='-1' -F 'limit'='-1' -F 'offset'='1' 'http://localhost/wiki/index.php?title=Special:Newpages'

Offset test case:
curl --silent --include --globoff -F 'namespace'='-1' -F 'limit'='1' -F 'offset'='-1' 'http://localhost/wiki/index.php?title=Special:Newpages'

Example test case output, with showing error details enabled:
-------------------
HTTP/1.1 100 Continue

HTTP/1.1 500 Internal Server Error
Date: Wed, 19 Dec 2007 06:13:57 GMT
Server: Apache
Cache-control: none
Pragma: nocache
Vary: Accept-Encoding,User-Agent
Content-Length: 1141
Connection: close
Content-Type: text/html; charset=utf-8


<html>
                <head>
                <title>Database error</title>
                </head>
                <body>
                <h1><img src='/wiki/skins/common/images/wiki.png' style='float:left;margin-right:1em' alt=''>Database error</h1>
                A database query syntax error has occurred.
This may indicate a bug in the software.
The last attempted database query was:
<blockquote><tt> SELECT 'Newpages' as type,
                                rc_namespace AS namespace,
                                rc_title AS title,
                                rc_cur_id AS cur_id,
                                rc_user AS &quot;user&quot;,
                                rc_user_text AS user_text,
                                rc_comment as &quot;comment&quot;,
                                rc_timestamp AS timestamp,
                                rc_timestamp AS value,
                                '1' as usepatrol,
                                rc_patrolled AS patrolled,
                                rc_id AS rcid,
                                page_len as length,
                                page_latest as rev_id
                        FROM `recentchanges`,`page`
                        WHERE rc_cur_id=page_id AND rc_new = '1' AND rc_namespace = '-1' AND page_is_redirect = '0' ORDER BY value DESC LIMIT -1,1 </tt></blockquote>
from within function "<tt></tt>".
MySQL returned error "<tt>1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1,1' at line 16 (localhost)</tt>".</body></html>
---------------------------

SVN ref: r28524. Prior to this was using: "list( $limit, $offset ) = wfCheckLimits();", and wfCheckLimits() has a check for negative values. Probably either use this function, or add abs() in appropriate locations.
Comment 1 Niklas Laxström 2007-12-22 20:20:15 UTC
Regression fixed in r28784.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links