]> git.koha-community.org Git - koha.git/commit
Bug 18854: Make sure offset will not be < 0 - protect from DoS
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 5 Jul 2017 13:44:55 +0000 (10:44 -0300)
committerKatrin Fischer <katrin.fischer.83@web.de>
Wed, 19 Jul 2017 21:18:01 +0000 (23:18 +0200)
commit36898c538bac3d861025635d96939fed8f927e10
tree0ff60e14c6010b9d9cfa75fd52669e048bcb524c
parent210f7cdcf340596542fd99e1ab603020c972a3b7
Bug 18854: Make sure offset will not be < 0 - protect from DoS

There was a bug that meant a very large offset in the search params
will cause the search script to run forever (or long enough to crash
the machine)

To test

1/ Get ready with sudo top so you can kill the thread before it causes
your machine to OOM
2/ Hit a page like yourdomain.com/cgi-bin/koha/opac-search.pl?q=1&offset=-9999999999999999999
3/ Notice the process runs for a long time
4/ Kill the process
5/ Apply the patch
6/ Hit the page again, notice the it loads (offset is set to zero)
7/ Do the same to search in the staff client

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit aabf001232fc46ee04cecb3a43fe8c0366a091df)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9939c7f3bf961e5b7789f4d64e0fc074408b71b1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
C4/Search.pm
Koha/SearchEngine/Elasticsearch/Search.pm