(LDAP) respect DB limits of arguments in an IN statement #25020
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
blizzz
requested review from
rullzer,
nickvergessen,
MorrisJobke,
ChristophWurst,
juliushaertl and
skjnldsv
|
/backport to stable20 |
|
/backport to stable19 |
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
blizzz
force-pushed
the
fix/noid/limitied-allowed-items-db-in
branch
from
82ffd50
to
6eca8d6
Compare
This was referenced Jan 8, 2021
|
I guess we could make the querybuilder always log a fatal when running with more than 1k ? |
Yep 👍 |
8 tasks
I had this thought briefly, although more in the direction that it would split it up itself. But didn't want to mess with the query and provoke odd behaviour. Logging a fatal makes sense. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Try to get a big list of users or groups from LDAP (you need to have them), for instance via
php occ ldap:search --limit=3500 ''. The actual number of users depends on the database in use. When it is too many, you may run intoSQLSTATE[HY000]: General error: 7 number of parameters must be between 0 and 65535(Postgres) orORA-01795: maximum number of expressions in a list is 1000(Oracle). Both MySQL/MariaDB and Sqlite do not have a specific limit of arguments, but of total bytes per statement. With 1000 entries (currently limited to 255bytes each) default values are not being exceeded.Background: when fetching users or groups from LDAP we collect the DN and fetch information from the database. In order to avoid a single read operation per entry, we collect them. Normally we do not need to deal with this huge numbers. Although, depending on the perspective, 1000 is already low. This is relevant when all users or groups are being fetched, which might happen. The prominent case for groups is the users page, as they are not paginated.