Fix ColleagueResponse.find(): string identity comparisons and unbound :subjectAbbvs parameter - #2
tarekabiramia wants to merge 3 commits into
Conversation
…Response.find()
Empty filter fields on the Colleague Message Responses screen are stored in
the HTTP session as "" (the form only clears attributes when null), and
`x != ""` compares object references — true for any runtime empty string.
The query then gains predicates like upper(courseNumber) = upper('') and
the screen shows zero rows until the user starts a new HTTP session.
All 8 sites (4 whereHql builders + 4 setParameter guards) change together,
otherwise Hibernate throws on a parameter/query mismatch.
The query builder unconditionally appended "rp.subjectCode in :subjectAbbvs",
but the binder only calls setParameterList when the list is non-empty.
Administrators get an empty subjects set from the action, so the clause was
added with nothing bound and Hibernate threw QueryParameterException
(':subjectAbbvs'). Guard the builder with the same emptiness condition the
binder uses — admins get no subject restriction (they see everything),
non-admins keep their scoping.
tomas-muller
left a comment
tomas-muller
left a comment
There was a problem hiding this comment.
Looks good to me. I only have one minor comment (see above).
To pull the request, we need a signed Contributor License Agreement with the Apereo Foundation. This can be done online at www.apereo.org/about/governance/licensing by following either the Individual Contributor License Agreement (ICLA) or the Corporate Contributor License Agreement (CCLA) link.
Review feedback on PR UniTime#2: fold the guard into "else if" so the subjectAbbvs list is not built and iterated when subjects is empty. The setParameterList binder already skips a null/empty list.
Comment addressed. I'll sign the agreement soon and keep you posted |
2 participants
Two small bug fixes in
ColleagueAddOn/JavaSource/org/unitime/colleague/model/ColleagueResponse.java, both hit on the Colleague Message Responses screen (UniTime 4.9 + Colleague add-on on Tomcat 10.1, MySQL).1.
!= ""string identity comparisons make empty filters behave as real filtersfind()guards its optional filters withx != "". That compares object references, and the filter values coming back from the HTTP session are runtime-constructed empty strings (the form only clears session attributes when the value is null), so the guard is true for empty input. The query then gains predicates likeupper(rp.courseNumber) = upper('')and the screen returns zero rows until the user starts a fresh HTTP session.Fixed by replacing the identity comparisons with
!x.isEmpty()at all 8 sites the 4whereHqlbuilders and the 4 matchingsetParameterguards must change together, otherwise Hibernate throws on a parameter/query mismatch.2.
:subjectAbbvspredicate appended even when no subject list is boundThe query builder unconditionally appends
rp.subjectCode in :subjectAbbvs, but the binder only callssetParameterListwhen the subject list is non-empty. Administrators reachfind()with an empty subject set, so the clause was added with nothing bound and Hibernate threwQueryParameterException: could not locate named parameter [subjectAbbvs].Fixed by guarding the builder with the same emptiness condition the binder uses: admins get no subject restriction (they see all rows), non-admin users keep their subject-area scoping.