View Issue Details

IDProjectCategoryView StatusLast Update
0034824mantisbtperformancepublic2024-10-17 08:22
Reporterdregad Assigned Todregad  
PrioritynormalSeveritytweakReproducibilityalways
Status resolvedResolutionfixed 
Target Version2.28.0Fixed in Version2.28.0 
Summary0034824: Multiple execution of the same query with Profile API functions
Description

The Profile API does not use a cache, so repeated calls to its functions results in a database query being executed multiple times to retrieve the same data (e.g. profile_ensure_can_update() followed by profile_get_row() and profile_is_global() in account_prof_edit_page.php and account_prof_update.php).

This is generally not an issue, as in most cases the API is only called to retrieve data for a single profile (e.g. IssueAddCommand.php, mc_api.php, filter_form_api.php...)

Considering this, implementing a caching mechanism would probably be overkill, but a simple refactoring of the API to return an object for the read-only functions would allow a single SQL query to get the data, and improve the code by encapsulating logic.

Additional Information

I noticed this while working on 0034640.

I outlined the ProfileData class then, but decided to delay tests and merging until after 2.27.0 was released.

TagsNo tags attached.

Relationships

related to 0034640 closeddregad CVE-2024-45792: Insecure Direct Object References vulnerability with user profiles 
related to 0034854 closedatrol Error when creating global profiles 

Activities

Related Changesets

MantisBT: master b1fe6a00

2024-09-25 19:00

dregad


Details Diff
Refactor Profile API - new ProfileData class

Using an object to handle Profiles avoids repeated SQL queries to
retrieve the same Profile information from the database.

This initial implementation only supports read-only operations for now;
add, update and delete are still managed with legacy functions.

These 3 functions have been replaced by ProfileData methods, which they
are now simple proxies for. They have been marked as deprecated, and
will be removed in a future release.
- profile_get_row()
- profile_get_name()
- profile_is_global()

Fixes 0034824
Affected Issues
0034824
mod - account_prof_edit_page.php Diff File
mod - account_prof_update.php Diff File
mod - api/soap/mc_api.php Diff File
mod - core/commands/IssueAddCommand.php Diff File
mod - core/filter_form_api.php Diff File
mod - core/profile_api.php Diff File
mod - core/user_api.php Diff File
mod - print_all_bug_page_word.php Diff File