lucene-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "David Smiley (Commented) (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (SOLR-3161) Use of 'qt' should be restricted to searching and should not start with a '/'
Date Mon, 12 Mar 2012 15:40:37 GMT

    [ https://issues.apache.org/jira/browse/SOLR-3161?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13227619#comment-13227619
] 

David Smiley commented on SOLR-3161:
------------------------------------

BTW I forgot to add a CHANGES.txt in my patch pending commit; it will be as follows:
{quote}
Upgrading from Solr 3.5
----------------------
SOLR-3161: <requestDispatcher handleSelect="false"> is now the default.  An existing
config will probably work as-is because handleSelect was explicitly enabled in default configs.
HandleSelect makes /select work as well as enables the 'qt' parameter.  Instead, consider
explicitly configuring /select as is done in the example solrconfig.xml, and register your
other search handlers with a leading '/' which is a recommended practice. 
{quote}

Erik, I very much agree with your sentiment that the dispatching logic get moved out of SolrDispatchFilter
and get simplified and made configurable and clear in the solrconfig.xml. IMO, the current
situation should stay in place in 3x (notwithstanding additions of safety checks to prevent
qt=/update).  4x/trunk could then get your DispatchingRequestHandler (credit to Hoss for the
idea) and _removal_ of SolrRequestDispatcher's handleSelect.

By the way, I _suspect_ that assuming "/select" works is so ingrained into various parts of
Solr, that we may want to log a warning if there isn't one registered at this path.  Maybe
I'm wrong but we'll see as we proceed.
                
> Use of 'qt' should be restricted to searching and should not start with a '/'
> -----------------------------------------------------------------------------
>
>                 Key: SOLR-3161
>                 URL: https://issues.apache.org/jira/browse/SOLR-3161
>             Project: Solr
>          Issue Type: Improvement
>          Components: search, web gui
>            Reporter: David Smiley
>            Assignee: David Smiley
>             Fix For: 3.6, 4.0
>
>         Attachments: SOLR-3161-disable-qt-by-default.patch, SOLR-3161-dispatching-request-handler.patch,
SOLR-3161-dispatching-request-handler.patch
>
>
> I haven't yet looked at the code involved for suggestions here; I'm speaking based on
how I think things should work and not work, based on intuitiveness and security. In general
I feel it is best practice to use '/' leading request handler names and not use "qt", but
I don't hate it enough when used in limited (search-only) circumstances to propose its demise.
But if someone proposes its deprecation that then I am +1 for that.
> Here is my proposal:
> Solr should error if the parameter "qt" is supplied with a leading '/'. (trunk only)
> Solr should only honor "qt" if the target request handler extends solr.SearchHandler.
> The new admin UI should only use 'qt' when it has to. For the query screen, it could
present a little pop-up menu of handlers to choose from, including "/select?qt=mycustom" for
handlers that aren't named with a leading '/'. This choice should be positioned at the top.
> And before I forget, me or someone should investigate if there are any similar security
problems with the shards.qt parameter. Perhaps shards.qt can abide by the same rules outlined
above.
> Does anyone foresee any problems with this proposal?
> On a related subject, I think the notion of a default request handler is bad - the default="true"
thing. Honestly I'm not sure what it does, since I noticed Solr trunk redirects '/solr/' to
the new admin UI at '/solr/#/'. Assuming it doesn't do anything useful anymore, I think it
would be clearer to use <requestHandler name="/select" class="solr.SearchHandler"> instead
of what's there now. The delta is to put the leading '/' on this request handler name, and
remove the "default" attribute.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org


Mime
View raw message