Bug 18854: Make sure offset will not be < 0 - protect from DoS
There was a bug that meant a very large offset in the search params will cause the search script to run forever (or long enough to crash the machine) To test 1/ Get ready with sudo top so you can kill the thread before it causes your machine to OOM 2/ Hit a page like yourdomain.com/cgi-bin/koha/opac-search.pl?q=1&offset=-9999999999999999999 3/ Notice the process runs for a long time 4/ Kill the process 5/ Apply the patch 6/ Hit the page again, notice the it loads (offset is set to zero) 7/ Do the same to search in the staff client Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
parent
99b32717cd
commit
aabf001232
|
|
@ -332,6 +332,7 @@ sub getRecords {
|
|||
|
||||
my @servers = @$servers_ref;
|
||||
my @sort_by = @$sort_by_ref;
|
||||
$offset = 0 if $offset < 0;
|
||||
|
||||
# Initialize variables for the ZOOM connection and results object
|
||||
my $zconn;
|
||||
|
|
|
|||
|
|
@ -149,6 +149,7 @@ sub search_compat {
|
|||
) = @_;
|
||||
my %options;
|
||||
$options{offset} = $offset;
|
||||
$offset = 0 if $offset < 0;
|
||||
$options{expanded_facet} = $expanded_facet;
|
||||
my $results = $self->search($query, undef, $results_per_page, %options);
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue