Recent Topics

1 Jan 31, 2005 22:11    

Running version 0.9.0.11 with clean urls enabled, I wrote up a post about a hack for limiting who gets to edit posts, and I called it "limiting who blah blah blah". I posted it and went to the blog because I always do that. I noticed that the "prev/next" links normally found under the posts died for a MySQL error.

Since I use both the original "posts_nav_link" and a hack for "single_posts_nav_link" I decided to break them in half with an HR between them. I expected it to be my hack, but the HR never showed up. Thus the failure was from the original posts_nav_link. That function looks simple but really goes deep so I used the error to troubleshoot. There was an "INNER JOIN" in the error message, and it ended with "WHERE post_urltitle = '". (The single quote was the end of the error message.) I searched the installation for INNER JOIN and found it in 3 places in b2evocore/_functions_bposts.php, and only one of those places referenced post_urltitle: the Item_get_by_title function.

I have hacks in that area by the way, but those hacks go back to the .8.6 days and have not been an issue.

Using phpmyadmin I checked the post_urltitle to see if there was anything funny about it that would make MySQL choke, and a stroke of intuition hit me. The first 5 characters in the title is also a keyword for MySQL: LIMIT. I changed the post_urltitle from "limiting_who . . . " to "lim_iting_who . . . " and everything works the way it's supposed to.

I have not gone to my v10 or CVS installations to attempt to duplicate it, and I did not turn off clean urls and test v11 that way. Sorry, but I have no clue how to fix this issue. I just think it's neato and figured I'd let y'all know about it.

2 Jan 31, 2005 22:15

A bit more info, sorry. What's funny is that when I was on a regular blog page, meaning showing my 10 posts per page, the failure did not happen. It happened only when I was on a single post page (permalink), and only when I was on the post with the title beginning with limit.

3 Feb 04, 2005 17:56

have you applied the recent security issue patch?

4 Feb 04, 2005 18:35

Yes, but let me check again real quick...

_class_itemlist is patched but I gotta do a WinMerge on the other file to the original to my version to make sure. be right back...

That one took a while, but _functions_bposts is also patched. I unzipped the v11 package to identify the changes in the patch file, then verified the two new IFs were in my version.

In a fit of coincidental timing, I just upgraded my test installation to v11 (including the patch) to make sure Kubrick looks and works correctly in the latest and greatest, so I tried a test post called "Limit test" and got the same error on the permalink page. The only changes to that installation are (a) stuff in skins/skinname folders, (b) conf/_config as per normal, and (c) conf/_advanced to change the cookie name (forget the exact param but default is b2evo and I'm using b2eskins).


Form is loading...