Last modified: 2014-04-25 07:07:24 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T52078, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 50078 - Database::delete() bug: when $conds is a string, makeList( ... LIST_AND) is applied, but should not
Database::delete() bug: when $conds is a string, makeList( ... LIST_AND) is a...
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
Database (Other open bugs)
1.22.0
All All
: Normal normal (vote)
: 1.22.x release
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-24 01:19 UTC by T. Gries
Modified: 2014-04-25 07:07 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---
mah: Backport_to_Stable+
aklapper: Backport_WMF-


Attachments

Description T. Gries 2013-06-24 01:19:18 UTC
I think I discovered a problem with the delete wrapper $conds argument.

Database::delete documentation says that $conds maybe string|array, but when string is given, it is also treated with makeList( ..., LIST_AND) -- instead treated as plain database statement (e.g. when $conds is manually constructed as explained in [1])

Database::delete
lines 2714 seq.:
if ( $conds != '*' ) {
  $sql .= ' WHERE ' . $this->makeList( $conds, LIST_AND );
}


$conds needs to be tested for string or array before makeList is applied, in my view.

If $conds is a string, then the statement should - in my view - be

  $sql .= ' WHERE ' . $conds;

Shouldn't it ?

[1] https://www.mediawiki.org/wiki/Manual:Database_access#Wrapper_function:_select.28.29
"Arguments are either single values (such as 'category' and 'cat_pages > 0') or arrays, if more than one value is passed for an argument position (such as array('cat_pages > 0', $myNextCond)). If you pass in strings, you must manually use DatabaseBase::addQuotes() on your values as you construct the string, as the wrapper will not do this for you. "
Comment 1 Gerrit Notification Bot 2013-06-25 14:19:00 UTC
Related URL: https://gerrit.wikimedia.org/r/70423 (Gerrit Change Id5a8220d21245669f1091a3b5ed1def65b22d375)
Comment 2 Gerrit Notification Bot 2013-06-25 14:19:02 UTC
Related URL: https://gerrit.wikimedia.org/r/70423 (Gerrit Change Id5a8220d21245669f1091a3b5ed1def65b22d375)
Comment 3 Gerrit Notification Bot 2013-06-25 17:18:12 UTC
https://gerrit.wikimedia.org/r/70423 (Gerrit Change Id5a8220d21245669f1091a3b5ed1def65b22d375) | change APPROVED and MERGED [by jenkins-bot]
Comment 4 T. Gries 2013-06-25 23:18:52 UTC
fixed with https://gerrit.wikimedia.org/r/#/c/70423/
Comment 5 T. Gries 2013-06-26 00:44:41 UTC
Dear core developers, this fix should perhaps be backported to older versions. I never asked for this, so bear with me, if I am wrong...
Comment 6 T. Gries 2013-06-26 00:46:08 UTC
Remark: the fix is required by https://gerrit.wikimedia.org/r/#/c/69017/
Comment 7 Alex Monk 2013-06-26 01:17:37 UTC
Regarding Backport_WMF: What issues does this actually fix in WMF production?
Comment 8 T. Gries 2013-06-26 01:54:42 UTC
(In reply to comment #7)
> Regarding Backport_WMF: What issues does this actually fix in WMF production?

perhaps none, at least, I don't know any - see my "disclaimer" Dear core developers, this fix should perhaps be backported to older versions.
I never asked for this, so bear with me, if I am wrong... in comment5 . 

So this Backport_WMF flag can perhaps be removed, but I feel not competent to decide this.
Comment 9 Mark A. Hershberger 2013-08-20 23:03:14 UTC
just saw this on 1.19.  Will fix.
Comment 10 Gerrit Notification Bot 2013-08-20 23:04:57 UTC
Change 80157 had a related patch set uploaded by MarkAHershberger:
(bug 50078) Allow a string other than '*' as condition for DatabaseBase::delete()

https://gerrit.wikimedia.org/r/80157
Comment 11 Gerrit Notification Bot 2013-08-20 23:14:55 UTC
Change 80157 merged by MarkAHershberger:
(bug 50078) Allow a string other than '*' as condition for DatabaseBase::delete()

https://gerrit.wikimedia.org/r/80157
Comment 12 T. Gries 2014-04-25 06:36:52 UTC
André: just as an example: under certain circumstances, the Extension:UserMerge needs this patch to allow a multi-row delete, and this requires a LIST_OR condition (instead of LIST_AND as default). See https://git.wikimedia.org/blob/mediawiki%2Fextensions%2FUserMerge/c74427a0f6934f877a398a78e579dc96b9d9be12/UserMerge_body.php#L374 . 

I found the description 

"Database::delete documentation says that $conds maybe string|array, but when string is given, it is also treated with makeList( ..., LIST_AND) -- instead treated as plain database statement (e.g. when $conds is manually constructed as explained in [1])" 

wrong 

when compared to what the core code was actually doing on that date 2013-06-24.

So not backporting this means (only) that the extension UserMerge might fail on such wikis.
Comment 13 Andre Klapper 2014-04-25 07:06:05 UTC
T.Gries: You set the backport flag 10 months ago so any WMF branches have already superseded any such backport request for 9 1/2 months.
Comment 14 T. Gries 2014-04-25 07:07:24 UTC
ah, yes

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links