An infinite loop in views/include/handlers.inc (824-826) can cause denial of service under some conditions involving broken/bad views from third party modules.
The infinite loop occurs when views_get_table_join returns null, which may be caught during development, with the developer module enabled. This is caused by bad, broken or misconfigured third party modules.
When whatchdog dblog and or syslog modules are enabled this causes a flood of watchdog notices, which can quickly eat all of the disk space available, leading to denial of service.
I propose to solve the infinite loop issue, as we can't know how views_get_table_join is used in the wild.
while (!empty($r_join) && $r_join->left_table != $base_table) {
$r_join = views_get_table_join($r_join->left_table, $base_table);
}
Comments
Comment #1
dikini commentedPatch removing the possibility of an infinite loop
Comment #2
dikini commentedComment #3
john morahan commentedComment #4
pal4life commented+1 we just experienced this on one of our sites as well. It was also giving the ajax error on dev sites.
Comment #5
dikini commentedanyone out there?
Comment #6
damienmckennaComment #7
dsnopekThe security team evaluated if this needed to be handled in private and fixed with an SA, but decided that it can be handled in public because it's not exploitable without adding a custom module and a View that depends on it, and if an attacker has permission to do that, you have much bigger problems. :-) Re-publishing this issue!
Comment #8
damienmckennaWe'll include this in the next release.
Comment #9
dawehnerI'm curious, doesn't this problem exist in Drupal 8 core as well?
Comment #11
damienmckennaCommitted. Thanks.
Comment #12
dawehnerThis needs a port to Drupal 8. Can someone open up an issue for that, please?