Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request-URI Too Long when performing several searches without resetting #1

Closed
smileBeda opened this issue Jun 9, 2022 · 1 comment

Comments

@smileBeda
Copy link
Member

When a user performs a number of searches, the URI gets longer and longer, resulting finally in a

The requested URL's length exceeds the capacity limit for this server.
Additionally, a 414 Request-URI Too Long error was encountered while trying to use an ErrorDocument to handle the request.

The fix should be to reset the search URL parameters when a user submits a new search.
Found by Mark Davenport at CP.

@smileBeda
Copy link
Member Author

The issue was the wp_nonce_field I used in the Form was passing the _wp_http_referer (this is the default behaviour)
Now, it seems WP does not update the existing GET _wp_http_referer but simply keeps adding on and on.
Thus, not passing _wp_http_referer is the solution. (second argument of wp_nonce_field set to false)

Note, this is not any more unsafe than CP Core itself is. As a matter of facts, CP Core does not even check nonce on the search forms in the admin.
So, this plugin is still safer, on the other hand, it is also not really a dangerous operation to perform a GET search, so that probably is why CP Core itself does not even check the nonce for such search forms.

Of course, my plugin checks capabilities on init and thus, only folks with actual manage_plugins caps can use/perform search.

I pushed the fix to version 1.1.3
.3 release because I also fixed 2 more bugs.
One of them is a shame. The plugin cannot, in its current 1.1.0 version, update itself 😱
It can starting from 1.1.3
In 1.1.0, it will warn you there is an update but the plugin will only deactivate, nothing else.
So a manual update is needed for this release, after that, the updates will work as well for this plugin inside the admin screen.

Terribly sorry about that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant