Re: Wierd interaction when filtering by id and boolean expression

Hi Ralf:

In message <[email protected]>,
Ralf Schlatterbeck writes:
>On Sat, Jun 08, 2024 at 06:35:29AM -0400, John P. Rouillard wrote:
>> 
>> With the following index url:
>> 
>> .../issue?@columns=title,id,creator&@sort=id\
>>    &@filter=id,creator\
>>    &id=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20\
>>    &creator=3,1,-4,4,-4,-2
>> 
>> I get what I expect. None of the issues that are returned were created
>> by user3, user1, or user4 and all the issues have id's in the set 1..20.
>> 
>> Now if I change this to use: `&creator=3,1,-4,4,-4` I get issues
>> created by user3, user1 or user4. However the issues that are returned
>> include id's greater than 20. I haven't changed the parameters for
>> @filter or id, just creator.
>
>Are you sure that you have full search permissions on everything?
>We're ignoring search parameters where the user doesn't have
>permissions. Silently.

This happens if I am logged in as admin or demo user.

[...]
>> Note that even using: @creator=3,1,-4 fails the same way. So
>> explicitly expressing 'OR' using -4 causes other filters to be
>> discarded somehow. That's my working hypothesis, but how/why, got me.
>
>Yes, this looks like it. I cannot imagine, though, why a set of search
>parameters should affect other search parameters.
>
>> Can somebody try a similar experiment on their tracker and see if this
>> weirdness happens on your tracker? Bonus points if you can figure out
>> what's happening here.
>
>One thing to look into is if you have search permissions (or even better
>view permissions) on all tables involved.

As admin I certainly should and demo looks like it has the correct
perms as well.

Any other ideas?

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.