683956 - query gives no response if no user supplied to editusers.cgi

Status: RESOLVED INVALID

(Bugzilla :: Administration, task)

Description

[Wayne Mery (:wsmwk)]

run https://bugzilla.mozilla.org/editusers.cgi?action=list&matchvalue=login_name&matchtype=substr&groupid=10&matchstr=
i.e. with no userid and it just loops. firefox indicates "connecting"

This isn't something someone would normally do of course, but I have a firefox keyword for this, and I forgot to supply the BMO user's address

Comment 1

[Frédéric Buclin]

It simply returns all users from the DB, so it takes time before you get any output.

Comment 2

[David Lawrence [:dkl]]

(In reply to Frédéric Buclin from comment #1)
> It simply returns all users from the DB, so it takes time before you get any
> output.

One possible way this could be a bug is should we allow this to happen in the first place then? Some large installations could have 10s of thousands of users which you probably want to display. Maybe treat it similar to buglist.cgi and require some search parameters.

dkl

Comment 3

[Frédéric Buclin]

No, we don't want another parameter for this. Only power users can access admin pages, and they should know what they do. On smaller installations, it makes sense to easily get all users, so we wouldn't want to prevent this behavior. Wayne just has to fix his Firefox keyword to pass %s and that's it.

Comment 4

[David Lawrence [:dkl]]

I wasn't really saying add another parameter for this. Only to require either something to be entered in the search string field OR the "Restrict users to belonging to group" checkbox be checked. 

Technically if an admin *wants* all users to be displayed they can enter '.*' in the search field and do a regexp search.

But I am also fine with just leaving this as-is and telling others to just not do it I suppose.

dkl