[bug] resthandler allows multi delete

[claudiobosticco]

SmartClient Version: v8.3p_2013-06-22/PowerEdition Deployment (built 2013-06-22)

While testing RESTHandler, I've found that a remove operation with an empty criteria is allowed.
server side log:

 
2013-06-28 15:09:54,361 DEBUG RestRequestParser Parsing json object: '{"endRow":10,"dataSource":"JPC_LISTINI","operationType":"delete","startRow":0,"data":{}}' 
2013-06-28 15:09:54,369 DEBUG HttpSessionEventPublisher Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade@3c18257c] 
2013-06-28 15:09:54,370 INFO  LegendRestHandler Performing 1 operation(s) 
2013-06-28 15:10:14,594 INFO  SQLWhereClause [builtinApplication.JPC_LISTINI_delete] empty condition 
2013-06-28 15:10:14,605 INFO  SQLDriver [builtinApplication.JPC_LISTINI_delete] Executing SQL update on 'dbJpcEP': DELETE FROM DBSALES.JPC_LISTINI WHERE ('1'='1') 
2013-06-28 15:10:14,612 WARN  RequestContext dsRequest.execute() failed:  
java.sql.SQLIntegrityConstraintViolationException: ORA-02292: restrizione di integrità violata (DBSALES.FK_SETTORI_TO_STAGIONI_PERIODI) - chiave figlia trovata

	at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:457)
	at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:400)
	at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:926)
	at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:476)
	at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:200)
	at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:543)
	at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:238)
	at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:1446)
	at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1757)
	at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:4372)
	at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:4539)
	at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:5577)
	at org.apache.tomcat.dbcp.dbcp.DelegatingPreparedStatement.executeUpdate(DelegatingPreparedStatement.java:105)
	at org.apache.tomcat.dbcp.dbcp.DelegatingPreparedStatement.executeUpdate(DelegatingPreparedStatement.java:105)
	at org.apache.commons.dbcp.DelegatingPreparedStatement.executeUpdate(DelegatingPreparedStatement.java:102)
	at com.isomorphic.sql.SQLDriver.doUpdate(SQLDriver.java:774)
	at com.isomorphic.sql.SQLDriver.update(SQLDriver.java:724)
	at com.isomorphic.sql.SQLDriver.executeUpdate(SQLDriver.java:848)
	at com.isomorphic.sql.SQLDataSource.executeNativeUpdate(SQLDataSource.java:427)
	at com.isomorphic.sql.SQLDataSource.SQLExecute(SQLDataSource.java:1476)
	at com.isomorphic.sql.SQLDataSource.processRequest(SQLDataSource.java:314)
	at com.isomorphic.sql.SQLDataSource.executeRemove(SQLDataSource.java:270)
	at com.isomorphic.datasource.DataSource.execute(DataSource.java:1376)
	at com.isomorphic.application.AppBase.executeDefaultDSOperation(AppBase.java:726)
	at com.isomorphic.application.AppBase.executeAppOperation(AppBase.java:658)
	at com.isomorphic.application.AppBase.execute(AppBase.java:491)
	at com.isomorphic.datasource.DSRequest.execute(DSRequest.java:2033)
	at com.isomorphic.servlet.RESTHandler.handleDSRequest(RESTHandler.java:341)
	at com.juve.legend.LegendRestHandler.handleDSRequest(LegendRestHandler.java:48)
	at com.isomorphic.servlet.RESTHandler.processRequest(RESTHandler.java:319)
	at com.isomorphic.servlet.RESTHandler.doPost(RESTHandler.java:259)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
	at com.isomorphic.servlet.BaseServlet.service(BaseServlet.java:152)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at com.juve.utils.Log4jSessionFilter.doFilter(Log4jSessionFilter.java:65)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:163)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at com.isomorphic.servlet.CompressionFilter.doFilter(CompressionFilter.java:246)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at com.isomorphic.js.JSSyntaxScannerFilter.doFilter(JSSyntaxScannerFilter.java:241)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:76)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1002)
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:722)
2013-06-28 15:10:18,931 DEBUG RPCManager Content type for RPC transaction: text/html; charset=UTF-8 
2013-06-28 15:10:18,934 DEBUG RPCManager non-DMI response, dropExtraFields: false

adding operationBinding.allowMultiUpdate="false" didn't help.

an update operation without primary key is (correctly) not allowed.

[claudiobosticco]

sorry, I've just realized that the operationType is "delete", instead of the correct "remove" which behaves correctly when a primaryKey is not present.

Now the question is: why is the erroneous "delete" operationType raising a sql delete ??

[Isomorphic]

"delete" is an undocumented alias for "remove", there for back-compat reasons. However, the code that checks for the presence of PK values in an update or remove operation was not taking account of this. It's fixed now - the fix will be present in 8.3 and 9.0 builds as of tomorrow, 7/3

[claudiobosticco]

SmartClient Version: v8.3p_2013-07-03/PowerEdition Deployment (built 2013-07-03)

verified, thank you very much.