fabrik 3.9.2: dbjoin autocomplete no longer works

[henk]

I use (SELECT clients.full_name FROM clients WHERE clients.id = {thistable}.client) in the concat field of a dbjoin element. This was working well for fabrik 3.9, but after update to 3.9.2. this stopped working.
If I replace autocomplete by dropdown I get the correct list of client full-names to select from.
The autocomplete starts searching but never shows a result.

 

[troester]

I can't replicate.
Can you see JS errors in your browser console?

 

[henk]

Yes, I also have JS errors:

autocomplete-bootstrap.js:3 Uncaught TypeError: e.map is not a function
at Object.populateMenu (autocomplete-bootstrap.js:3)
at Object.e.extend.$owner (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38)
at Object.completeAjax (autocomplete-bootstrap.js:3)
at Object.e.extend.$owner (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38)
at Object.<anonymous> (autocomplete-bootstrap.js:3)
at Object.<anonymous> (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42)
at Array.forEach (<anonymous>)
at Function.forEach (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:5)
at Array.each (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:9)
at Object.fireEvent (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42)
populateMenu @ autocomplete-bootstrap.js:3
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
completeAjax @ autocomplete-bootstrap.js:3
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
(anonymous) @ autocomplete-bootstrap.js:3
(anonymous) @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42
(anonymous) @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:5
each @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:9
fireEvent @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
onSuccess @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:160
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
success @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:160
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
onStateChange @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:159
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
XMLHttpRequest.send (async)
send @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:164
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
send @ mootools-more.js?c5d68e83eeaae8caf179849eb8172783:248
search @ autocomplete-bootstrap.js:3
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
(anonymous) @ autocomplete-bootstrap.js:3
exec @ jquery.ba-throttle-debounce.js:149
setTimeout (async)
wrapper @ jquery.ba-throttle-debounce.js:182
dispatch @ jquery.min.js?c5d68e83eeaae8caf179849eb8172783:2
v.handle @ jquery.min.js?c5d68e83eeaae8caf179849eb8172783:2

 

[troester]

Can you enable "Debug JS" in Fabrik Options/Debugging "Allow Fabrik Debug" and try again to get a more informative line number?

 

[henk]

OK, now I have:

autocomplete-bootstrap.js:207 Uncaught TypeError: data.map is not a function
at Object.populateMenu (autocomplete-bootstrap.js:207)
at Object.e.extend.$owner (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38)
at Object.completeAjax (autocomplete-bootstrap.js:175)
at Object.e.extend.$owner (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38)
at Object.<anonymous> (autocomplete-bootstrap.js:153)
at Object.<anonymous> (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42)
at Array.forEach (<anonymous>)
at Function.forEach (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:5)
at Array.each (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:9)
at Object.fireEvent (mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42)
populateMenu @ autocomplete-bootstrap.js:207
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
completeAjax @ autocomplete-bootstrap.js:175
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
(anonymous) @ autocomplete-bootstrap.js:153
(anonymous) @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42
(anonymous) @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:5
each @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:9
fireEvent @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:42
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
onSuccess @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:160
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
success @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:160
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
onStateChange @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:159
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
XMLHttpRequest.send (async)
send @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:164
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
send @ mootools-more.js?c5d68e83eeaae8caf179849eb8172783:248
search @ autocomplete-bootstrap.js:163
e.extend.$owner @ mootools-core.js?c5d68e83eeaae8caf179849eb8172783:38
(anonymous) @ autocomplete-bootstrap.js:75
exec @ jquery.ba-throttle-debounce.js:149
setTimeout (async)
wrapper @ jquery.ba-throttle-debounce.js:182
dispatch @ jquery.min.js?c5d68e83eeaae8caf179849eb8172783:2
v.handle @ jquery.min.js?c5d68e83eeaae8caf179849eb8172783:2

 

[henk]

I tracked down the error.
It seems that the commit on 8 Aug 2019 : Fix for vulnerability with autocomplete is causing this error
If I remove the changes from line 6822: public function onAutocomplete_options() then the problem is solved.

So far I didn't dig deeper yet, but maybe a variable in autocomplete-bootstrap.js is an object while an array should be used ?

 

[troester]

Dbjoin autocomplete is working on my site (also with Concat label).
To exclude Concat label issues: is it working if you use just the "label"?

If the fix you mentioned is the reason it seems that you are hitting one of those vulnerablities.
How to you call your form? Do you have any access restrictions?

For debugging: Can you also check responses in the Network tab of you browser?
index.php?...plugin_databasejoin&method=autocomplete_options... should show a JSON like
[{"value":"33","text":"some label"....
I assume in your case it may show an error message.

 

[henk]

Already tried to exclude Concat label: I get the same error even if I use just the "label".
The dbjoin works well if I use dropdown.

Good tip to check access setting:

Most access for fabrik item is set to "special", some are set for super-user.
The form is called by a menuitem, access is set for "special".
"special" is for users in user-groups manager, author & super-users .
I created 2 extra user-groups in
-> manager

-> administrator

-> allow-extra
-> block-extra​

The logged-in user (where the error occurrs) is assigned to the "block-extra" group.
If I change login to super-user, I don't get the error. Of course this is not what I want as a solution.

How is this vulnerablity check working??

 

[henk]

OK, I found out that the error occurrs because access for the dbjoin element was set for "special".
After change to "public" all worked well.
So be carefull to set different access for elements.

I also found that "Uncaught TypeError: e.map is not a function" can be prevented by changing $0 in the public function onAutocomplete_options() to an array:

$o = array();

// Check for request forgeries
if ($formModel->spoofCheck() && !JSession::checkToken('request'))
{

$o[] = FText::_('JERROR_ALERTNOAUTHOR');
echo json_encode($o);// but nothing is shown
return;​

}
if (!$this->canUse()) {

$o[] = FText::_('JERROR_ALERTNOAUTHOR');
echo json_encode($o);// but nothing is shown
return;​

}

The text for JERROR_ALERTNOAUTHOR however is never shown.