This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 48853ea334 Introducing upper bound for rowCount in MultiForm-Requests
(#1691) (#1716)
48853ea334 is described below
commit 48853ea33419f025c889b551aa9e8871f876d47d
Author: Ashish Vijaywargiya <[email protected]>
AuthorDate: Mon Aug 24 18:03:33 2026 +0530
Introducing upper bound for rowCount in MultiForm-Requests (#1691) (#1716)
Introducing upper bound for rowCount in MultiForm-Requests.
Cherry-picked from trunk commit
fc2aa905f88e7e66be320589909b218da574566b, resolving an import-order-only
conflict (this branch is still on javax.servlet, trunk has already moved
to jakarta.servlet in an unrelated cleanup); no functional changes were
needed beyond that.
Thank you Lukas-Finster and Krishna Uprit for your help on this.
Co-authored-by: Lukas-Finster <[email protected]>
---
.../accounting/webapp/accounting/WEB-INF/controller.xml | 1 +
.../src/main/java/org/apache/ofbiz/base/util/UtilHttp.java | 10 ++++++++++
framework/common/config/general.properties | 3 +++
.../apache/ofbiz/webapp/event/ServiceMultiEventHandler.java | 9 ++++++++-
4 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/applications/accounting/webapp/accounting/WEB-INF/controller.xml
b/applications/accounting/webapp/accounting/WEB-INF/controller.xml
index 33de741de3..69c20e498f 100644
--- a/applications/accounting/webapp/accounting/WEB-INF/controller.xml
+++ b/applications/accounting/webapp/accounting/WEB-INF/controller.xml
@@ -2051,6 +2051,7 @@ under the License.
<response name="success" type="view" value="BankReconciliation"/>
</request-map>
<request-map uri="getFinAccountTransRunningTotalAndBalances">
+ <security https="true" auth="true"/>
<event type="service-multi"
invoke="getFinAccountTransRunningTotalAndBalances"/>
<response name="success" type="request" value="json"/>
<response name="error" type="request" value="json"/>
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
index 09c1d6e955..beee8d521d 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
@@ -104,6 +104,8 @@ public final class UtilHttp {
private static final String COMPOSITE_DELIMITER = "_c_";
private static final int MULTI_ROW_DELIMITER_LENGTH =
MULTI_ROW_DELIMITER.length();
private static final int ROW_SUBMIT_PREFIX_LENGTH =
ROW_SUBMIT_PREFIX.length();
+ private static final int MAX_MULTI_FORM_ROWS =
UtilProperties.getPropertyAsInteger(
+ "general", "multiform.max.rows", 1000);
private static final String SESSION_KEY_TIMEZONE = "timeZone";
private static final String SESSION_KEY_THEME = "visualTheme";
@@ -1669,6 +1671,11 @@ public final class UtilHttp {
Debug.logWarning("Invalid value for row index found: " +
maxRowIndex, MODULE);
}
}
+ if (rowCount > MAX_MULTI_FORM_ROWS) {
+ Debug.logWarning("Multi form row count " + rowCount + " exceeds
the maximum "
+ + MAX_MULTI_FORM_ROWS + ", clamping to it", MODULE);
+ rowCount = MAX_MULTI_FORM_ROWS;
+ }
return rowCount;
}
@@ -1806,4 +1813,7 @@ public final class UtilHttp {
return allowedProtocolList;
}
+ public static int getMaxMultiFormRowCount() {
+ return MAX_MULTI_FORM_ROWS;
+ }
}
diff --git a/framework/common/config/general.properties
b/framework/common/config/general.properties
index 598f4d3293..92f7658180 100644
--- a/framework/common/config/general.properties
+++ b/framework/common/config/general.properties
@@ -142,3 +142,6 @@
userDocUri=https://nightlies.apache.org/ofbiz/trunk/ofbiz/html5/user-manual.html
# -- Google API key, by default none, this is not free
googleApiKey=
+
+# -- Maximum of allowed rows for MultiFormRequests
+multiform.max.rows=1000
\ No newline at end of file
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
index ca0298a39c..006172e98d 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
@@ -145,6 +145,11 @@ public class ServiceMultiEventHandler implements
EventHandler {
if (rowCount < 1) {
throw new EventHandlerException("No rows to process");
}
+ // The number of multi form rows excedes the configured maximum
+ if (rowCount > UtilHttp.getMaxMultiFormRowCount()) {
+ throw new EventHandlerException("Too many rows submitted: " +
rowCount
+ + ", maximum is " + UtilHttp.getMaxMultiFormRowCount());
+ }
// some default message settings
String errorPrefixStr =
UtilProperties.getMessage("DefaultMessagesUiLabels", "service.error.prefix",
locale);
@@ -165,7 +170,9 @@ public class ServiceMultiEventHandler implements
EventHandler {
if (eventGlobalTransaction) {
// start the global transaction
try {
- beganTrans =
TransactionUtil.begin(modelService.getTransactionTimeout() * rowCount);
+ long timeout = Math.min((long)
modelService.getTransactionTimeout() * rowCount,
+ Integer.MAX_VALUE);
+ beganTrans = TransactionUtil.begin((int) timeout);
} catch (GenericTransactionException e) {
throw new EventHandlerException("Problem starting
multi-service global transaction", e);
}
