EasyFix: Fix Error 500 when sorting users list by fullname.
Review Request #10155 — Created Sept. 21, 2018 and discarded
When appending ?sort=fullname to /users/, ReviewBoard attempts to query and
sort on 'fullname' which is not a correct field and causes an Error 500 to
occur. Although most manual sort queries will be discarded as improper,
fullname is allowed as a sort field because it corresponds to a Column name on
the page. This has been fixed by detecting the special case for 'fullname' in
grids.py and if 'fullname' is in the sort query, it is removed and replaced
with 'first_name' and 'last_name' which are its composite substrings.
Tested with Review Board 3.0.x by manually attempting ?sort=fullname and ?sort=-fullname on /users/, as well as sorting by fullname and username, and going back and forth between the fullname sort cases and username sort cases. I encountered no issues on my testing once the fix was applied.
Description | From | Last Updated |
---|---|---|
Can you update your description to explain what the bug was and how your change fixes it? See https://www.notion.so/reviewboard/Writing-Good-Change-Descriptions-10529e7c207743fa8ca90153d4b21fea for … |
david | |
David touched upon an important point, the location of where the change should be made. This change is too broad, … |
chipx86 | |
W293 blank line contains whitespace |
reviewbot | |
W293 blank line contains whitespace |
reviewbot | |
W293 blank line contains whitespace |
reviewbot | |
W293 blank line contains whitespace |
reviewbot | |
E111 indentation is not a multiple of four |
reviewbot | |
E251 unexpected spaces around keyword / parameter equals |
reviewbot | |
E251 unexpected spaces around keyword / parameter equals |
reviewbot | |
F821 undefined name 'F' |
reviewbot | |
F821 undefined name 'F' |
reviewbot | |
W293 blank line contains whitespace |
reviewbot | |
Remove this blank line. |
brennie | |
And this one. |
brennie | |
This comment doesn't explain why we're oing this. Also comments should be full sentences (i.e., end with a period). |
brennie | |
And this one. |
brennie | |
I think this was accidentally added to your patch. Can you please remove this from the commit, and re-post? |
mike_conley | |
Please delete this file from your review request. You can do git rm package-lock.json and git commit --amend -C HEAD |
brennie | |
W293 blank line contains whitespace |
reviewbot | |
I just noticed what file this is in. The DataGrid class should be entirely generic--it's easily possible that someone could … |
david | |
There's no need for the u prefix. We use Unicode strings by default. |
chipx86 |
- Change Summary:
-
Fixed whitespace complaints.
- Commit:
-
2de5372758290c0f8b4b5dd87d2372fe967d429a10ca816c714a3588c6058b1cc235bd204954812d
- Diff:
-
Revision 2 (+4249)
Checks run (2 succeeded)
- Change Summary:
-
Remove package-lock.json
- Commit:
-
10ca816c714a3588c6058b1cc235bd204954812da1c2efd72401657f0b92f138003fb69ac27362eb
- Diff:
-
Revision 3 (+10)
Checks run (2 succeeded)
- Change Summary:
-
Comment for fullname fix code better explains why it is necessary and is in proper sentence format with full stops.
- Commit:
-
a1c2efd72401657f0b92f138003fb69ac27362eb4f7533dac2f6b25bf1ccab45ab2f8c27971c84af
- Diff:
-
Revision 4 (+13)
Checks run (2 succeeded)
-
Hey Jeff, I re-opened some of Barret's issues because those newlines still look like they're in the latest revision.
- Change Summary:
-
Remove unnecessary linebreaks.
- Commit:
-
4f7533dac2f6b25bf1ccab45ab2f8c27971c84afac151aeea0be8d0f240b09a22bf01ac975589a30
- Diff:
-
Revision 5 (+10)
- Change Summary:
-
Accidental tab got in there.
- Commit:
-
ac151aeea0be8d0f240b09a22bf01ac975589a30e02a8f6a2e4b5f373ccdf3c8a61d8a7718230160
- Diff:
-
Revision 6 (+10)
Checks run (2 succeeded)
-
-
Can you update your description to explain what the bug was and how your change fixes it? See https://www.notion.so/reviewboard/Writing-Good-Change-Descriptions-10529e7c207743fa8ca90153d4b21fea for our guide on this.
You should also list the bug number in the "Bugs" field, and not in the description.
- Change Summary:
-
Updated Summary, Description, Testing Done, and Bugs to be in line with conventions.
- Summary:
-
Avoid ?sort=fullname causing Error 500 by replacing with first_name, last_nameEasyFix: Fix Error 500 when sorting users list by fullname.
- Description:
-
~ EasyFix [#4607]: Trying to sort by fullname in "Users" page cause "error 500".
~ When appending ?sort=fullname to /users/, ReviewBoard attempts to query and sort on 'fullname' which is not a correct field and causes an Error 500 to occur. Although most manual sort queries will be discarded as improper, fullname is allowed as a sort field because it corresponds to a Column name on the page. This has been fixed by detecting the special case for 'fullname' in grids.py and if 'fullname' is in the sort query, it is removed and replaced with 'first_name' and 'last_name' which are its composite substrings.
- Testing Done:
-
~ Tested with 3.0.x using manual ?sort=fullname, ?sort=-fullname, and flipping back and forth with ?sort=username
~ Tested with Review Board 3.0.x by manually attempting ?sort=fullname and ?sort=-fullname on /users/, as well as sorting by fullname and username, and going back and forth between the fullname sort cases and username sort cases. I encountered no issues on my testing once the fix was applied.
- Bugs:
- Change Summary:
-
Hard wrapping description to 79 chars.
- Description:
-
~ When appending ?sort=fullname to /users/, ReviewBoard attempts to query and sort on 'fullname' which is not a correct field and causes an Error 500 to occur. Although most manual sort queries will be discarded as improper, fullname is allowed as a sort field because it corresponds to a Column name on the page. This has been fixed by detecting the special case for 'fullname' in grids.py and if 'fullname' is in the sort query, it is removed and replaced with 'first_name' and 'last_name' which are its composite substrings.
~ When appending ?sort=fullname to /users/, ReviewBoard attempts to query and
+ sort on 'fullname' which is not a correct field and causes an Error 500 to + occur. Although most manual sort queries will be discarded as improper, + fullname is allowed as a sort field because it corresponds to a Column name on + the page. This has been fixed by detecting the special case for 'fullname' in + grids.py and if 'fullname' is in the sort query, it is removed and replaced + with 'first_name' and 'last_name' which are its composite substrings.
-
-
I just noticed what file this is in. The
DataGrid
class should be entirely generic--it's easily possible that someone could use this for a model that does include a column namedfullname
.Can we instead make the change in Review Board's
reviewboard.datagrids.grids.UsersDataGrid
? We can add aprecomute_objects
override that first makes necessary changes toself.sort_list
and then calls the superclass' version.
-
-
David touched upon an important point, the location of where the change should be made. This change is too broad, as DataGrids are used for many things.
Another thing that's important is the design of the change. This change is somewhat of a "bandaid." It's addressing a symptom of the problem, but the real problem is that we were trying to allow sorting on the fullname field (which does not have
sortable=True
, so it shouldn't even be possible), when it's not really a field. It's working around an improper setting. Albeit in an interesting way -- turning it into two sortable fields.So let's boil down the real issues:
- We're allowing values in
?sort=
that are not valid sortable columns. This needs to be fixed (and have a unit test proving it). - We want to allow sorting on the Full Name header, but we want something more specialized with the sorting (sorting by first name and then last name).
Issue #1 -- Bad Sort Values
The fix would be to add some validation where we're processing
self.request.GET.get('sort', ...)
ingrids.py
. It needs to be updated to make sure that each value in there is something we can sort on. Each must be something that a column could return. So an approach would be to first loop through all columns being shown on the datagrid that havesortable=True
and then fetch the sortable database field from each, put those all in aset()
, and then ignore any value in?sort=
that aren't in that set. This fixes not only?sort=fullname
, but?sort=whatever
.Issue #2 -- Smarter Sorting of Full Names
Let's make a proper design for this, rather than working around a limitation in the current design. Columns can specify the database field they'd like to use for sorting through
Column.get_sort_field()
, which defaults to returningself.db_field
. If you search, you'll find where we callget_sort_field()
, and how it places the result in the list of fields to sort with. How about we update this to allow returning a list/tuple? Then we can have:class FullNameColumn(...): ... def get_sort_field(self): return ('first_name', 'last_name')
The code that create the sort list can check if it got multiple items from this call, and add each independently to the sort list.
This would require a change in Djblets to provide this capability (plus a matching unit test), and a second change in Review Board to define this method for the column.
Summary
That's three review requests: 1 for the sorting fix (fix + unit test), 1 for the Djblets multi-field sorting (implementation + unit test), 1 for defining
FullNameColumn.get_sort_field
in Review Board.Sound good? I can go over this with you on Slack if it helps.
- We're allowing values in
-