Project

General

Profile

Actions

Defect #14902

closed

Potential invalid SQL error with invalid group_ids

Added by Ty You over 11 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Normal
Category:
Issues
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

In 2.3.2-devel, when a tracker is either a parent or child record and has no assignee, non-admin users receive an Internal 500 error wafter clicking on the Subject of the tracker in the Issues list. Details of the error are as follows:

Started GET "/issues/50" for 192.168.50.63 at Fri Sep 13 14:16:44 -0500 2013
Processing by IssuesController#show as HTML
Parameters: {"id"=>"50"}
Current user:XYZPDQ (id=14)
Rendered issues/_action_menu.html.erb (3.7ms)
Rendered issues/show.html.erb within layouts/base (13.0ms)
Completed 500 Internal Server Error in 252ms

ActionView::Template::Error (Mysql::Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')))) OR (projects.is_public = 1 AND ((issues.is_private = 0 OR issues.author_id ' at line 1: SELECT `issues`.`id` AS t0_r0, `issues`.`tracker_id` AS t0_r1, `issues`.`project_id` AS t0_r2, `issues`.`subject` AS t0_r3, `issues`.`description` AS t0_r4, `issues`.`due_date` AS t0_r5, `issues`.`category_id` AS t0_r6, `issues`.`status_id` AS t0_r7, `issues`.`assigned_to_id` AS t0_r8, `issues`.`priority_id` AS t0_r9, `issues`.`fixed_version_id` AS t0_r10, `issues`.`author_id` AS t0_r11, `issues`.`lock_version` AS t0_r12, `issues`.`created_on` AS t0_r13, `issues`.`updated_on` AS t0_r14, `issues`.`start_date` AS t0_r15, `issues`.`done_ratio` AS t0_r16, `issues`.`estimated_hours` AS t0_r17, `issues`.`parent_id` AS t0_r18, `issues`.`root_id` AS t0_r19, `issues`.`lft` AS t0_r20, `issues`.`rgt` AS t0_r21, `issues`.`is_private` AS t0_r22, `issues`.`closed_on` AS t0_r23, `projects`.`id` AS t1_r0, `projects`.`name` AS t1_r1, `projects`.`description` AS t1_r2, `projects`.`homepage` AS t1_r3, `projects`.`is_public` AS t1_r4, `projects`.`parent_id` AS t1_r5, `projects`.`created_on` AS t1_r6, `projects`.`updated_on` AS t1_r7, `projects`.`identifier` AS t1_r8, `projects`.`status` AS t1_r9, `projects`.`lft` AS t1_r10, `projects`.`rgt` AS t1_r11, `projects`.`inherit_members` AS t1_r12, `projects`.`dmsf_description` AS t1_r13 FROM `issues` LEFT OUTER JOIN `projects` ON `projects`.`id` = `issues`.`project_id` WHERE `issues`.`root_id` = 56 AND (`issues`.`lft` <= 6 AND `issues`.`rgt` >= 7) AND (`issues`.id != 50) AND (((projects.status <> 9 AND projects.id IN (SELECT em.project_id FROM enabled_modules em WHERE em.name='issue_tracking')) AND ((projects.id IN (7,39,38,34,41,40,53,8,9,10,11,25,26,27,37,33,13,14,12,48,47,36,35,30) AND ((issues.is_private = 0 OR issues.author_id = 14 OR issues.assigned_to_id IN (14,,)))) OR (projects.is_public = 1 AND ((issues.is_private = 0 OR issues.author_id = 14 OR issues.assigned_to_id IN (14,,)))) OR (projects.id IN (31,53,52,45,44,50,51,49,29,30) AND ((issues.is_private = 0 OR issues.author_id = 14 OR issues.assigned_to_id IN (14,,))))))) ORDER BY `issues`.`lft`):
22: <%= avatar(@issue.author, :size => "50") >
23:
24: <div class="subject">
25: <
= render_issue_subject_with_tree(@issue) >
26: </div>
27: <p class="author">
28: <
= authoring @issue.created_on, @issue.author %>.
app/helpers/issues_helper.rb:66:in `render_issue_subject_with_tree'
app/views/issues/show.html.erb:25:in `_app_views_issues_show_html_erb__407699512_73517660'
app/controllers/issues_controller.rb:123:in `show'
app/controllers/issues_controller.rb:120:in `show'

_____________________________________________
Redmine issue reported by Todd Young on 9/13/13

Actions

Also available in: Atom PDF