Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SQL Error because of suhosin-blocked article_id #45

Closed
GoogleCodeExporter opened this issue Mar 14, 2015 · 8 comments
Closed

SQL Error because of suhosin-blocked article_id #45

GoogleCodeExporter opened this issue Mar 14, 2015 · 8 comments
Labels
migrated-from-googlecode

Comments

@GoogleCodeExporter
Copy link 

What steps will reproduce the problem?
1. just browsing through the feeds articles
2. clicking on a feed to see a list of articles

What is the expected output? What do you see instead?
i saw an error message instead of the list of articles. but after clicking away 
the error message the list of articles appeared.

What version of the product are you using? On what operating system?
ttrss-reader-fork 0.8.3 on android 2.2.1

Please provide any additional information below.
My log entry on my server tells me the following:
suhosin[16710]: ALERT - configured GET variable value length limit exceeded - 
dropped variable 'article_id' (attacker '###.###.218.250', file 
'ttrss/api/index.php')

in the sql-query the error occured there were empty brackets. so it failed. it 
was a select query like this:
select * from tablename WHERE article_id IN () and ...
you can see the empty brackets.
i will make a picture if the error accours once more. 

should i configure my suhosin on my server more slackier?

Original issue reported on code.google.com by strubblm...@gmail.com on 1 Feb 2011 at 10:34
@GoogleCodeExporter
Copy link
Author 

Just a guess: Did the feed have lots of unread articles (hundreds?)? The 
articles are fetched by querying for every ID like this: 
http://.../api/?op=getArticle&sid=---&article_id=16375,16376,16377,16378,16379..
. so if you have 100 unread articles your query will be around 600 characters 
long. Guess suhosin takes this as an attack with a link containing too much 
data.

Greetings,
nils

Original comment by nils.braden on 2 Feb 2011 at 9:45

@GoogleCodeExporter
Copy link
Author 

Okay, here the pic of the error message.

Original comment by strubblm...@gmail.com on 2 Feb 2011 at 3:50

Attachments:

@GoogleCodeExporter
Copy link
Author 

So how many unread articles do you have in the feed where this happens?

Original comment by nils.braden on 3 Feb 2011 at 10:05

@GoogleCodeExporter
Copy link
Author 

often I have a lot unread articles (>100) when getting this error message. 
i'll write down some example numbers when i am going to use this app next time.

Original comment by strubblm...@gmail.com on 10 Feb 2011 at 2:53

@GoogleCodeExporter
Copy link
Author 

Okay, i have tested it with some feeds. the error occurs if the has e.g. 231, 
132 or 75 unread feed items. 

the feed with the 75 unread items doesn't throw the exception if there are only 
67 unread articles.

Original comment by strubblm...@gmail.com on 10 Feb 2011 at 11:21

@GoogleCodeExporter
Copy link
Author 

Attached a build with splitting of long requests, can you please try it?

Original comment by nils.braden on 10 Feb 2011 at 6:42

  • Changed state: Accepted

Attachments:

@GoogleCodeExporter
Copy link
Author 

i'll test it with the new version 0.8.6. i'll give feedback.

Original comment by strubblm...@gmail.com on 12 Feb 2011 at 6:41

@GoogleCodeExporter
Copy link
Author 

Seems to be fine. Pls open new report if it doesn't work.

Original comment by nils.braden on 14 Mar 2011 at 9:30

  • Changed state: Fixed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
migrated-from-googlecode
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@GoogleCodeExporter