Repeaters page creation loop until server crash

[Francesco Bortolussi]

Hi to everyone, please try to consider this post as a possible thread to every PW installation.

We have used PW to backend  a website and app for a big big company, so stability must be granted.

Recently  we was into a big trouble, filesystem was blocked because no Inodes left. The assets/files/ folder was full with more than 7 million directories.

After some research we found a possible origin to this:

If we have a template user, which have assigned a repeater field. And then we set as parent of that repeater a "User" page,  this could lead into an infinite loop of pages creation; because the template_id for the repeater pages was set to "User Template" and since "User Template" includes that repeater it will need to create another page and you go on until your disk crash.

Usually repeaters should stay under Admin->Repeaters.

And here is the main questions:

Can a repeater page be created with the same template_id as his "container" page?

At database(Mysql) level does the template_id field will be filled with his parent template_id in the pages table when you import the repeater field?

(Sorry for that but filed means something for db schema too)

Could someone  tell me if this actually happen. If so, could this be checked in a future release to prevent this problems?

You should say, "How could this happen?" 

This happen when you have different environments and you migrate fields from one to another environment; a Page ID that is an Admin->Repeaters child page in one environment is not necessarily the same in another.

Thank you for your time reading.

[kongondo]

@Francesco Bortolussi

This is not an answer to your question. I am not fully certain that what you have reported is a security issue. For now, I have moved the thread to the 'General Support' area.

It would be good if you could file a bug report and provide other details as well (PW version, environment, etc). Thanks.

[Francesco Bortolussi]

Ok @kongondo

Thank you for the quick answer.

Processwire version:  2.6.23 rc2

Server: Linux, Ngnix, Maria DB, PHP-Fpm, EXT4 Filesystem

Problem: When you import a repeater field, PW don't validate the template of the parent_id field, and assign it to repeater page.

Reproduction steps: 

1.- Export a repeater field.

2.- When importing, edit the parent-id to match with the ID of a page which template contains that repeater.

3.- Pw enter's in a loop of repeater pages creation.

[horst]

This is an old PW version. Repeaterfields have gotten a complete overworking and additional features since then.

Does the new version (PW 3.0.45+) behave the same?

[Francesco Bortolussi]

Hi @horst haven't tested with newer version. Let us test and confirm.

[LostKobrakai]

Field import/export is even in recent processwire versions declared a beta/experimental feature to be used with care. So while this might sound harsh your issue is not more of an security issue than any other one a developer might introduce by uncareful actions. Especially the more complex fields like repeaters / pagetables are prone to miss-matches for some of the plain id values they're using, which is probably the no1 reason, why the feature never made it into stable form by now. 

The things to consider on processwire's side would be to make the import process customizable by fieldtype so that the repeater fieldtype can force an update of the parent_id on import. This can only work for repeaters, as the parent pages are not user changeable. The other thing to consider would be to make the pagefiles directory be lazily created, so that pages without actual files do not create directories. This wouldn't have prevented your infinite loops, but at least the part of filling up all your disk space.

[Francesco Bortolussi]

Thank you guys, I've posted this issue on GitHub.