Problem/Motivation
The '%' character is not escaped when used in an exposed filter.
Steps to reproduce
- Create a view page for nodes list
- Add a exposed filter for title
- Set operation to equals (=)
- Create nodes with title abc, abc%, abcd, abcde
- Visit created views page, type testing search string into exposed filter: "abc%"
Result:
View shows all four nodes (abc, abc%, abcd, abcde)
Expected:
Only node abc% should be shown as operation is set to equal and not to contains.
Proposed resolution
Call Database::getConnection()->escapeLike($value) for all values.
we can check #6, #7 for detail.
Remaining tasks
Review
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
Problem/Motivation
Comments
Comment #2
kfritscheAttached a patch for 8.8.x
Comment #3
kfritscheComment #4
kfritscheUps, forgot a semicolon :/
Comment #5
daffie commented@kfritsche: What does query now returns without your solution?
Comment #6
kfritsche@daffie:
Without the patch a % in the search works like a SQL LIKE.
So search for "a%" will return all entities which starts with an a, even if the operation is equal and in my mind should only return something if there is an entity which has the exact title "a%".
We needed this patch, as we have entity titles with % signs and want to search exactly for these.
Comment #7
daffie commented@kfritsche: I had another look at the code of the StringFilter filter and first I thought that the operator was an "=", but now I see that the operator is "LIKE". The solution in your patch is the correct. What we now are missing is an automated test to make sure that the solution does not get undone in the future.
Comment #14
quietone commented@kfritsche, Thank you for reporting this problem and making a patch.. We rely on issue reports like this to improve Drupal core.
I tested this on 9.3.9, standard install, and was not able to reproduce this error. I followed the steps given in the Issue Summary.
Therefore, closing as outdated.
If you are experiencing this problem on a supported version of Drupal reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue (starting from "Install Drupal core").
Comment #15
jimyhuang commentedThis issue still there. I tried patch 3055152-4.patch, it is correct.
Tested version: 10.3.2
Tested db: MariaDB
Problematic code: 11.x , 10.x
Reproduce step:
Comment #16
manpreet_singh commentedI have fixed the issue above-mentioned issue.
I attached the patch for the Drupal 10.3.5
Tested version: 10.3.5
Tested db: MariaDB
Thank you
Comment #18
quietone commentedI re-tested today with Umami on 11.x and was able to reproduce the problem. I can only assume that my earlier testing was incorrect.
@manpreet_singh, thanks for the fix. Drupal uses peer review for all changes to core, so the setting on an issue to RTBC should be done by another contributor. Thanks.
This issue will also need a test to prove the fix works and expected, adding tag.
Comment #19
shalini_jha commentedI have able to replicate this issue and MR fixes the issue , so i will work on this for test coverage.
Comment #20
shalini_jha commentedComment #21
shalini_jha commentedComment #26
shalini_jha commentedHi,
I was able to replicate the issue and reviewed the existing fix in this MR. The solution appears correct, and functionality works as expected based on my testing. To validate this, I have tried to add test coverage in the FilterStringTest class, aiming to demonstrate both the issue and its resolution.
I’ve submitted a new MR against 11.x. Since there was an existing MR on 10, I’ve hidden that one to avoid any confusion. I wasn’t sure about the status of the existing MR, Apologies if you would have preferred updating the existing MR.
Please review when possible, and let me know if there’s anything further I should address.
Updated issue summary also.
Thank you!
Failing test :
Comment #27
shalini_jha commentedMoving this for Review.
Comment #28
smustgrave commentedComment on MR.
Comment #29
shalini_jha commentedComment #30
shalini_jha commentedComment #31
shalini_jha commentedI have address the feedback, also verified with another method no type cast is added, also again re ran the test and its working as expected, pipeline is also green so moving this for NR.
Kindly review.
Comment #32
smustgrave commentedAll feedback appears to be addressed.
Comment #33
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.
Comment #34
shalini_jha commentedRebase without conflicts , so moving back to previous status.
Comment #35
quietone commentedI read the IS, comments and the MR. Everything looks in order here. I updated credit.
Comment #38
catchCommitted/pushed to 11.x and cherry-picked to 10.5.x, thanks!
Comment #41
Anonymous (not verified) commentedAfter this fix, hook_views_query_substitutions() no longer works correctly.
Because a
\is added before the_in the target strings, the replacements no longer match.