Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 295249

Adding escaping for the GROUP BY fields broke ROLLUP support

$
0
0

Problem/Motivation

By fixing #3191623: Select queries do not escape the GROUP BY fields, the support for the ROLLUP modifier in a GROUP BY clause has been removed.

After updating from Drupal 9.5.2 to Drupal 9.5.3, all my queries using ROLLUP stopped working.

Steps to reproduce

Using the following query and a Postgresql database :

$query = \Drupal::database()->select('users_field_data', 'u');
$query->addExpression('COUNT(u.uid)', 'count');
$query->groupBy('ROLLUP ("u"."status", "u"."langcode")');

dpm((string) $query);

we obtain the following results :

  • Drupal 9.5.2 : SELECT COUNT(u.uid) AS "count" FROM {users_field_data} "u" GROUP BY ROLLUP ("u"."status", "u"."langcode") OK 👍
  • Drupal 9.5.3 : SELECT COUNT(u.uid) AS "count" FROM {users_field_data} "u" GROUP BY "ROLLUPu"."statusu"."langcode" KO 👎

Proposed resolution

The patch adds a new optional argument: SelectInterface::groupBy($field, $modifier = '').

Another solution would be -- which can be found in the issue fork -- to add an argument to groupBy to disallow escaping. If that solution is chosen, the code needs updating to store the escape/notescape decision in a separate structure because Select::$group is essentially public so changing it is probably not desirable. However, keeping the escape on $field is probably more consistent and more secure.

Remaining tasks


Viewing all articles
Browse latest Browse all 295249

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>