This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new fc2aa905f8 Introducing upper bound for rowCount in MultiForm-Requests
(#1691)
fc2aa905f8 is described below
commit fc2aa905f88e7e66be320589909b218da574566b
Author: Lukas-Finster <[email protected]>
AuthorDate: Mon Aug 24 14:17:15 2026 +0200
Introducing upper bound for rowCount in MultiForm-Requests (#1691)
Introducing upper bound for rowCount in MultiForm-Requests.
Thank you Lukas-Finster and Krishna Uprit for your help on this.
---
.../webapp/accounting/WEB-INF/controller.xml | 1 +
.../java/org/apache/ofbiz/base/util/UtilHttp.java | 10 ++++++++++
framework/common/config/general.properties | 3 +++
.../ofbiz/webapp/event/ServiceMultiEventHandler.java | 19 +++++++++++++------
4 files changed, 27 insertions(+), 6 deletions(-)
diff --git a/applications/accounting/webapp/accounting/WEB-INF/controller.xml
b/applications/accounting/webapp/accounting/WEB-INF/controller.xml
index 8bc57a03cb..5c8769d3ce 100644
--- a/applications/accounting/webapp/accounting/WEB-INF/controller.xml
+++ b/applications/accounting/webapp/accounting/WEB-INF/controller.xml
@@ -2014,6 +2014,7 @@ under the License.
<response name="success" type="view" value="BankReconciliation"/>
</request-map>
<request-map uri="getFinAccountTransRunningTotalAndBalances">
+ <security https="true" auth="true"/>
<event type="service-multi"
invoke="getFinAccountTransRunningTotalAndBalances"/>
<response name="success" type="request" value="json"/>
<response name="error" type="request" value="json"/>
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
index e1958217cc..1e9dafaff7 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
@@ -106,6 +106,8 @@ public final class UtilHttp {
private static final String COMPOSITE_DELIMITER = "_c_";
private static final int MULTI_ROW_DELIMITER_LENGTH =
MULTI_ROW_DELIMITER.length();
private static final int ROW_SUBMIT_PREFIX_LENGTH =
ROW_SUBMIT_PREFIX.length();
+ private static final int MAX_MULTI_FORM_ROWS =
UtilProperties.getPropertyAsInteger(
+ "general", "multiform.max.rows", 1000);
private static final String SESSION_KEY_TIMEZONE = "timeZone";
private static final String SESSION_KEY_THEME = "visualTheme";
@@ -1696,6 +1698,11 @@ public final class UtilHttp {
Debug.logWarning("Invalid value for row index found: " +
maxRowIndex, MODULE);
}
}
+ if (rowCount > MAX_MULTI_FORM_ROWS) {
+ Debug.logWarning("Multi form row count " + rowCount + " exceeds
the maximum "
+ + MAX_MULTI_FORM_ROWS + ", clamping to it", MODULE);
+ rowCount = MAX_MULTI_FORM_ROWS;
+ }
return rowCount;
}
@@ -1833,4 +1840,7 @@ public final class UtilHttp {
return allowedProtocolList;
}
+ public static int getMaxMultiFormRowCount() {
+ return MAX_MULTI_FORM_ROWS;
+ }
}
diff --git a/framework/common/config/general.properties
b/framework/common/config/general.properties
index 598f4d3293..92f7658180 100644
--- a/framework/common/config/general.properties
+++ b/framework/common/config/general.properties
@@ -142,3 +142,6 @@
userDocUri=https://nightlies.apache.org/ofbiz/trunk/ofbiz/html5/user-manual.html
# -- Google API key, by default none, this is not free
googleApiKey=
+
+# -- Maximum of allowed rows for MultiFormRequests
+multiform.max.rows=1000
\ No newline at end of file
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
index 2f5fcf72dc..bf5cb866fd 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/ServiceMultiEventHandler.java
@@ -26,11 +26,6 @@ import java.util.Locale;
import java.util.Map;
import java.util.TimeZone;
-import jakarta.servlet.ServletContext;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-
import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilHttp;
@@ -50,6 +45,11 @@ import org.apache.ofbiz.service.ServiceValidationException;
import org.apache.ofbiz.webapp.control.ConfigXMLReader.Event;
import org.apache.ofbiz.webapp.control.ConfigXMLReader.RequestMap;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+
/**
* ServiceMultiEventHandler - Event handler for running a service multiple
times; for bulk forms
*/
@@ -145,6 +145,11 @@ public class ServiceMultiEventHandler implements
EventHandler {
if (rowCount < 1) {
throw new EventHandlerException("No rows to process");
}
+ // The number of multi form rows excedes the configured maximum
+ if (rowCount > UtilHttp.getMaxMultiFormRowCount()) {
+ throw new EventHandlerException("Too many rows submitted: " +
rowCount
+ + ", maximum is " + UtilHttp.getMaxMultiFormRowCount());
+ }
// some default message settings
String errorPrefixStr =
UtilProperties.getMessage("DefaultMessagesUiLabels", "service.error.prefix",
locale);
@@ -165,7 +170,9 @@ public class ServiceMultiEventHandler implements
EventHandler {
if (eventGlobalTransaction) {
// start the global transaction
try {
- beganTrans =
TransactionUtil.begin(modelService.getTransactionTimeout() * rowCount);
+ long timeout = Math.min((long)
modelService.getTransactionTimeout() * rowCount,
+ Integer.MAX_VALUE);
+ beganTrans = TransactionUtil.begin((int) timeout);
} catch (GenericTransactionException e) {
throw new EventHandlerException("Problem starting
multi-service global transaction", e);
}
