943636 - SQL error in quicksearch API when providing just a bug ID

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: API, defect)

Description

[Mark Côté [:mcote]]

Reproducible SQL error when loading https://bugzilla.mozilla.org/rest/bug?quicksearch=548571:

{"error":true,"code":100500,"message":"DBD::mysql::db selectall_arrayref failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AS bugs_bug_id\n  FROM bugs\nLEFT JOIN bug_group_map AS security_map ON bugs.bug_i' at line 1 [for Statement \"SELECT bugs.bug_id AS bug_id,  AS bugs_bug_id\n  FROM bugs\nLEFT JOIN bug_group_map AS security_map ON bugs.bug_id = security_map.bug_id\n WHERE bugs.creation_ts IS NOT NULL\n   AND security_map.group_id IS NULL\n   AND  bugs.bug_id IN (548571) \nGROUP BY bugs.bug_id\nORDER BY bugs_bug_id\nLIMIT 10000\n\"] at /data/www/bugzilla.mozilla.org/Bugzilla/Search.pm line 773.\n"}

Comment 1

[:glob ✱]

this doesn't happen upstream, investigating.

Comment 2

[David Lawrence [:dkl]]

This fixes it for me on bmo/4.2:

=== modified file 'Bugzilla/Search/Quicksearch.pm'
--- Bugzilla/Search/Quicksearch.pm	2013-10-18 15:56:02 +0000
+++ Bugzilla/Search/Quicksearch.pm	2013-11-27 05:34:34 +0000
@@ -317,7 +317,7 @@
     else {
         # List of bug numbers.
         $cgi->param('bug_id', $searchstring);
-        $cgi->param('order', 'bugs.bug_id');
+        $cgi->param('order', 'bug_id');
         $cgi->param('bug_id_type', 'anyexact');
     }
 }

Comment 3

[:glob ✱]

Attachment: 943636_1.patch

we need to backport bug 297382, which moves validation of the order parameter from bug_list.cgi to Bugzilla::Search.

Comment 4

[:glob ✱]

(In reply to David Lawrence [:dkl] from comment #2)
> This fixes it for me on bmo/4.2:
> -        $cgi->param('order', 'bugs.bug_id');
> +        $cgi->param('order', 'bug_id');

i suspect that will fail if the user has set their default set of columns to include a table which requires a join.

Comment 5

[David Lawrence [:dkl]]

Comment on attachment 8339069 [details] [diff] [review]
943636_1.patch

Review of attachment 8339069 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 6

[:glob ✱]

Committing to: bzr+ssh://[e-mail]/bmo/4.2/
modified buglist.cgi
modified Bugzilla/Search.pm
Committed revision 9166.

Comment 7

[:glob ✱]

this fix is now live.