269398 - request.cgi fails with error in SQL when no products available for user

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Sergey Basmanov]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686) Opera 7.54  [ru]
Build Identifier: 

This happens when all products restricted to their groups (selected 'Entry' and 
'Canedit') and a user that don't belongs to any of this groups attemps to query 
'My requests'. request.cgi does't handle situation when no products returned by 
query.

DBD::mysql::st execute failed: You have an error in your SQL syntax.  Check the 
manual that corresponds to your MySQL server version for the right syntax to use 
near ') ORDER BY name' at line 1 [for Statement "SELECT name, product_id FROM 
components WHERE product_id IN () ORDER BY name"] at Bugzilla/DB.pm line 62
        Bugzilla::DB::SendSQL('SELECT name, product_id FROM components WHERE 
product_id IN (...') called at globals.pl line 592
        main::GetSelectableProductHash() called at /var/www/html/bugzilla/
request.cgi line 263
        main::queue() called at /var/www/html/bugzilla/request.cgi line 50

Reproducible: Always
Steps to Reproduce:
1.For each product in Group Access Controls set 'Entry' and 'Canedit' flags.
2.Login as user that don't belongs to any of this groups.
3.Press 'My requests' link




This affects version 2.18rc3

Comment 1

[Dave Miller [:justdave]]

crash on page linked direct from main menu = critical

Comment 2

[Frédéric Buclin]

I think I have found the reason, see globals.pl line 626:

GetSelectableProducts(1) returns an empty list if the user cannot access any
product. But then, we request components, versions and milestones without
checking first if the product list is empty or not, so that we have something
like "WHERE product_id IN () ORDER BY...".

I think this is the reason why we get this error. I will check now and submit a
patch in a few minutes if I'm right.

Comment 3

[Frédéric Buclin]

Attachment: checks the number of products available

This solves the problem for me.

Comment 4

[Vlad Dascalu]

Comment on attachment 168412 [details] [diff] [review]
checks the number of products available

diff -w shows a one-liner on this patch :-)

This indeed solves the crash. r=vladd

We could as a nit display: no products available so can't query for requests,
but that's a nit and the important thing here, 2.18 blocking wise, is so solve
the crash.

Comment 5

[Vlad Dascalu]

Checking in globals.pl;
/cvsroot/mozilla/webtools/bugzilla/globals.pl,v  <--  globals.pl
new revision: 1.270.2.3; previous revision: 1.270.2.2
done

Checking in globals.pl;
/cvsroot/mozilla/webtools/bugzilla/globals.pl,v  <--  globals.pl
new revision: 1.278; previous revision: 1.277
done

Comment 6

[Frédéric Buclin]

*** Bug 232669 has been marked as a duplicate of this bug. ***

Comment 7

[Frédéric Buclin]

*** Bug 252373 has been marked as a duplicate of this bug. ***