527037 - Search.pm does not use the central bug visibility mechanism

Status: NEW

(Bugzilla :: Query/Bug List, defect)

Description

[Gervase Markham [:gerv]]

Bugzilla->user->visible_bugs is the central place for checking bug visibility.
buglist.cgi does not use it. It probably should. 

Of course, performance is more important here than in most places, so instead of ripping the visibility check out of the main query and adding it afterwards, we may want to keep the basic check in the main query (in order to keep the number of returned bugs down) and do an extra check afterwards. I don't know. My attached suggested patch uses this approach - it leaves the existing query alone but further filters the list of returned bugs through the visibility function.

Gerv

Comment 1

[Gervase Markham [:gerv]]

Attachment: Patch v.1

One way of doing it. The final patch wouldn't have my name in the comment.

Gerv

Comment 2

[Max Kanat-Alexander]

Comment on attachment 410811 [details] [diff] [review]
Patch v.1

No, that could result in an IN() clause with 10000 bugs IDs in it, which is likely to perform terribly.

I think the eventual solution to this is:

1) We make Search.pm return bug objects.

2) We allow visible_bugs to wrap a subselect.

3) We wrap the select that does the search in the visible_bugs code.

I suspect that databases will optimize that better, but I could be wrong.

It's also entirely possible that an IN() clause with 10,000 or 50,000 ids isn't even a problem (though on Oracle it would be quite a lot of SQL). But even just the weight of sending that query to the server and running it through the query optimizer would seem like a possible issue, to me (particularly in situations like Mozilla where the database server is a separate server).

Comment 3

[Patrick Porter]

Attachment: same problem

Thanks from weajabackrans1974.