The module can't edit or delete bookmarks with certain pathological URLs.

I haven't reviewed to code to get hints, but it seems like it's the length and/or special characters that trigger the defect.

CommentFileSizeAuthor
#5 bookmarks.module.patch797 bytesdaans

Comments

matt westgate’s picture

Please provide sample URLs to test.

fallacious’s picture

babybear’s picture

Version: » 4.6.x-1.x-dev
Assigned: Unassigned » babybear
Priority: Normal » Critical

the delete operation use $url:
"db_query("DELETE FROM {bookmarks} WHERE uid = %d AND url = '%s'", $user->uid, urldecode($url));"
and the $url is get by $_GET['url'],
so a wrong operation will be taken when the link string has additional '&url=' in it.

I suggest a 'bid' adding to the table,and the delete query change to
"db_query("DELETE FROM {bookmarks} WHERE uid = %d AND bid = %d", $user->uid, $bid);"
and it will enhance the performance!

daans’s picture

BabyBear your conclusion about the &url= part is wrong. This isn't a issue because urlencode() is used. Which means that the & is translated into %26. But the problem lies in the use of the '+'-sign.

Because the url is passed through urldecode() twice which means that the '+'-signs ar translated into spaces. So the Query fails.

I do agree that an bid field whould help a lot and also make is it easier to share bookmarks between users for example. I will post a patch tonight when I can acces my own computer instead of my brothers one ;)

daans’s picture

Status: Active » Needs review
StatusFileSize
new797 bytes

Attached is the promised patch. I have choosen to get rid of the extra urldecode in the function, because the url decoding shouldn't be done in one function and not all different functions.

deekayen’s picture

Committed to HEAD, DRUPAL-4-7, DRUPAL-4-6, and DRUPAL-4-5.

deekayen’s picture

Status: Needs review » Fixed
Anonymous’s picture

Status: Fixed » Closed (fixed)