View Issue Details

IDProjectCategoryView StatusLast Update
0017034Plugin - EmailReportingGeneralpublic2026-08-28 12:47
ReporterJeromyK Assigned ToSL-Gundam  
PrioritylowSeveritytweakReproducibilityalways
Status assignedResolutionopen 
Summary0017034: memory_limit in mantis email reporting plugin is set to -1
Description

We had problems with mantis 1.2.15 and PHP 5.3.4. The mantis email reporting plugin tries to set the PHP memory_limit to -1. That was refused, because setting the limit to -1 means: "No limit" and that is dangerous under some circumstances

Steps To Reproduce
  1. Install PHP 5.3.4
  2. Run ./plugins/EmailReporting/pages/bug_report_mail.php (with cronjob or manually)
TagsNo tags attached.
Attached Files
codebase.PNG (17,812 bytes)   
codebase.PNG (17,812 bytes)   
log.PNG (14,178 bytes)   
log.PNG (14,178 bytes)   

Activities

JeromyK

JeromyK

2014-02-26 05:01

reporter   ~0039547

Last edited: 2014-02-26 05:01

My solution was: Set the memory_limit in ./plugins/EmailReporting/pages/bug_report_mail.php' to '512M' instead of '-1'

JeromyK

JeromyK

2014-02-26 05:08

reporter   ~0039548

Oh... please move this ticket to the correct project -.- sorry for that...

bornoroni

bornoroni

2014-06-27 14:20

reporter   ~0040856

ok

marie0113

marie0113

2014-07-17 22:34

reporter   ~0040943

ok

SL-Gundam

SL-Gundam

2015-04-08 13:21

manager   ~0049345

Last edited: 2015-04-08 13:21

Does this stop script execution as a result of this error?

JeromyK

JeromyK

2015-04-09 02:57

reporter   ~0049368

No, it just drop the alert and refuse to set it.

But I think it only refuse because we use suhosin on our webservers: http://en.wikipedia.org/wiki/Suhosin

That means: Some webserver will set Memory_limit to -1 without any warning
-> And that would open a channel for a floating attack (because Mantis can now allocate all memory and the webserver could become unaccessable.

SL-Gundam

SL-Gundam

2015-04-09 11:20

manager   ~0049370

Last edited: 2015-04-09 11:59

Yes but EmailReporting only changes it for the current page request. Since the script is usually only run through a command shell and not through the browser this should not be an issue (hence the option: "Block this script from running via a webserver (recommended = "Yes")")

And since it only throws a warning but still properly executes the script thats not a major issue either

But i guess setting it to a high value should also have the desired result.

JeromyK

JeromyK

2015-04-14 05:20

reporter   ~0049395

Ok, so normally this script will not run throught the browser. That will make the possible amount of targets lower, but doesn't elimininate it.

Question: Is it necessary to set the value by mantis at all? Because setting it to any fix value could generate other problems (Value is higher than max memory...)

SL-Gundam

SL-Gundam

2015-04-14 11:59

manager   ~0049396

Default is allways fixed to 128MiB i believe

EmailReporting just requires decent amounts of memory when processing attachments so thats why that config change is included

JeromyK

JeromyK

2015-04-14 12:16

reporter   ~0049397

Then it's your Privileg to decide what to do :)

SL-Gundam

SL-Gundam

2015-04-14 20:20

manager   ~0049398

Last edited: 2015-04-14 21:37

Let me just confirm this

You don't get a warning when memory_limit is set above zero by a script. There is no upper limit to this?
You do get get a warning when its set to -1

I need to decide what to do when the memory limit is reached. We don't want EmailReporting to get stuck on that email and import it multiple times...

I will keep this issue open for a while until i've decided how best to handle situations past the memory limit

JeromyK

JeromyK

2015-04-15 03:49

reporter   ~0049400

I only know, that I receive a warning when it tries to set this value to -1 (Because -1 means "no limit"). Setting it to some other value below 0 is not defined, but I think, that would be ignored.

See also php reference: http://php.net/manual/en/ini.core.php -> memory_limit

You could use this function to determinate the max. memory, that can be allocated by php: http://php.net/manual/en/function.memory-get-usage.php

After that, you can set the value to something lower than that :).

And (to be very serious) you have to check first that PHP-Version is > 5.2.1 (otherwise, memory_get_use is probably not present :)).

JeromyK

JeromyK

2015-04-15 03:53

reporter   ~0049401

Check if PHP-Version is => 5.2.1

SL-Gundam

SL-Gundam

2015-04-15 10:02

manager   ~0049404

That function only shows the memory currently being used by the PHP process, not the maximum it could use

Memory usage is already outputted by EmailReporting when debug mode is activated ;)

JeromyK

JeromyK

2015-04-15 10:24

reporter   ~0049405

Right... I shouldn't do more than three things at one time ;). So you could probably use this for windows_servers:
http://php.net/manual/en/function.win32-ps-stat-mem.php

And that for Linux:
http://stackoverflow.com/questions/1455379/get-server-ram-with-php (/proc/meminfo)

Maybe to big for the EmailReporting-Plugin, better integrate it in mantis core and give plugins global variables to read this values out.

SL-Gundam

SL-Gundam

2015-04-15 11:00

manager   ~0049406

Right that will all help to decide what to set the max memory usage to. But thats the easy part as i could also just give people a configuration option with which they can do this manually

The biggest problem to address is if EmailReporting passes the memory limit set (however high it is) and the script stops execution. Usually EmailReporting will process the email in question every execution since it never comes to the moment where the email is deleted.
Deleting the email before processing it fully is also not an option as it potentially could result in emails being deleted without the user knowing it

maybe just adding a configuration option where the user can decide what the maximum email size is that should be processed. But what to do with the email that passes this size limit.

JeromyK

JeromyK

2015-04-15 11:11

reporter   ~0049407

You could check the size before processing and refuse, if the mail is bigger than the maximum size. (That only reduces, not eliminate the error)

A DB-value where you count the tries on a particular mailobject and stop parsing the email, if the count rise to high? (I would build a key on subject, Sender and some other informations.)

SL-Gundam

SL-Gundam

2026-08-28 12:47

manager   ~0071389

EmailReporting 0.12.1 will introduce a config option for this.

It will need more work though for proper attachment limitations.