[MNT-13767] Using disjunction "OR" in CMIS query returns wrong number of results when SOLR 4 is used Created: 01-Apr-15  Updated: 04-Nov-15  Resolved: 29-May-15

Status: Closed
Project: Service Packs and Hot Fixes
Component/s: Search and Indexing (non-UI)
Affects Version/s: 5.0.0.5
Fix Version/s: 5.0.2

Type: Service Pack Request
Reporter: Rosa Abbaspour [X] (Inactive) Assignee: Closed Bugs (Inactive)
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: 0 minutes
Time Spent: 1 day, 6 hours
Original Estimate: Not Specified
Environment:

Alfresco 5.0.0.5, 5.0.1, 5.0.2 - solr4
opencmis-workbench-0.12.0-full

Attachments: JPEG File 01_cmisadminlogin.jpg     JPEG File 02_AminQueryBeforePermissionChange.jpg     JPEG File 03_ChangePermission_text1.jpg     JPEG File 04_ChangePermission_text2.jpg     JPEG File 05_AminQueryAfterPermissionChange.jpg     JPEG File 06_user1QueryAfterPermissionChange.jpg    
Issue Links:
Cloners
is cloned by MNT-14368 CLONE - Using disjunction "OR" in CMI... Closed
is cloned by MNT-14388 CLONE - Using disjunction "OR" in CMI... Closed
Duplicate
is duplicated by MNT-14003 SOLR4 duplicating results when changi... Closed
is duplicated by MNT-14969 Changing permissions results in dupli... Closed
Related
is related to by MNT-14537 AIO SDK 2.1 ONLY "QueryModelException... Closed
is related to by MNT-14578 Alfresco CMIS gets inconsistent resul... Closed
Bug Priority:
Category 3
ACT Numbers:

00353945, 00379051, 00439664, 00452090

Build Location: https://releases.alfresco.com/Enterprise-5.0/5.0.2/build-00086/ALL

 Description   

Using disjunction "OR" in CMIS query returns wrong number of results when SOLR 4 is used.

Environment:
Alfresco 5.0.0.5, 5.0.1, 5.0.2 (checked with both solr1 and solr4).
For CMIS query 'opencmis-workbench-0.12.0-full' has been used.

Steps to reproduce:
1- In Alfresco Share invite a user to a site (e.g. "user1" with "Consumer" role)

2 - In document library of a site create two items of content: "test1.txt" and "test2.txt"

3- In workbench the following cmis query returns two results for both "user1" and "admin":
SELECT * FROM cmis:document WHERE cmis:name like '%test1%' or cmis:name like '%test2%' order by cmis:name

4- Disable inheritance for both "test1.txt" and "test2.txt" and add "user1" to have permission on "test1.txt" (e.g. "Site Consumer")

5- Run the same cmis query again with admin user:
SELECT * FROM cmis:document WHERE cmis:name like '%test1%' or cmis:name like '%test2%' order by cmis:name

Expected behaviour:
The query returns 2 records: one record for test1.txt and one for test2.txt

Observed behaviour:
The query returns 4 records: two records for test1.txt and two records for test2.txt. (duplicates the result)

6- Run this query with "user1" user:
SELECT * FROM cmis:document WHERE cmis:name like '%test1%' or cmis:name like '%test2%' order by cmis:name

Expected behaviour:
The query returns 1 records: test1.txt that this user has permission on that.

Observed behaviour:
It displays "runtime: Unauthorized" error message.

Analysis to date:

  • If "OR" disjunction is removed in the query, it displays correct number of results:
    SELECT * FROM cmis:document WHERE cmis:name like '%test1%'
    This returns one result with admin user and one result with user "user1"

SELECT * FROM cmis:document WHERE cmis:name like '%test2%'
This returns one result with admin user and no result with user "user1"

  • Reverting the permission to the default value doesn't fix the issue. Query still displays 4 records for admin.
  • This issue is NOT reproducible in Solr 1.
  • Log messages after enabling the following debugs:
    log4j.logger.org.alfresco.solr.query.AbstractQParser=DEBUG
    log4j.logger.org.alfresco.repo.search.impl.solr.SolrQueryHTTPClient=debug
Logging

DEBUG [org.alfresco.repo.search.impl.solr.SolrQueryHTTPClient] [http-apr-8080-exec-3] Sent :/solr4/alfresco/cmis?wt=json&fl=DBID%2Cscore&rows=100&df=TEXT&start=0&locale=en_AU&alternativeDic=DEFAULT_DICTIONARY&cmisVersion=CMIS_1_0&fq=%7B%21afts%7DAUTHORITY_FILTER_FROM_JSON&fq=%7B%21afts%7DTENANT_FILTER_FROM_JSON

DEBUG [org.alfresco.repo.search.impl.solr.SolrQueryHTTPClient] [http-apr-8080-exec-3] with:

Unknown macro: {"queryConsistency"}

DEBUG [org.alfresco.repo.search.impl.solr.SolrQueryHTTPClient] [http-apr-8080-exec-3] Got: 4 in 892 ms

 Comments   
Comment by Rosa Abbaspour [X] (Inactive) [ 07-Apr-15 ]

I've checked this in versions 5.0.1 and 5.0.2 and updated the steps in the jira accordingly:

  • Step 3 (step 4 in Alex comment) returns both documents for "user1" (same result as Alex test result). It appears in Alfresco 5.0.1 and 5.0.2 this issue is not happening for this user anymore.
    However step 5 still returns 4 results for admin and error message "runtime: Unauthorized" for user "user1".

I'm using this URL to bind from CMIS Workbench http://localhost:8080/alfresco/api/-default-/public/cmis/versions/1.1/atom

  • Solr4 FIX/RETRY or revert to the default permission couldn't change the result this time.
  • The reason I used "OR" term is because if I remove it in query the issue doesn't happen. For example the following queries are returning correct number of results for both "admin" and "user1":

SELECT * FROM cmis:document WHERE cmis:name like '%test1%' => one result with admin user and one result with user "user1"
SELECT * FROM cmis:document WHERE cmis:name like '%test2%' => one result with admin user and no result with user "user1"

The issue happens after disabling permission inheritance only if we use "OR" in the query.
I also attached a few screenshots from Alfresco 5.0.2 environment.

Comment by Pavel Yurkevich (Inactive) [ 13-Apr-15 ]

This issue occurs because solr index is not updated properly. Before re-indexing updated metadata we should remove existing entry from index for updated node (or specify overwrite flag=true for AddUpdateCommand).

Currently we use tenant, aclId, dbid as unique key to find/remove/create document in solr index. After changing permissions for node the new aclId is assigned to this node. As a result old record is not removed from index and is not overwritten because there is no corresponding document in index for this key tenant, newAclId, dbid.

I suggest remove existing document by using only node DBID. I guess it should be unique. Please review r101738

Comment by Alan Davis [ 15-Jul-15 ]

Please note to fix this issue requires both the fix AND a re-index, because Solr 4 index may already contains the wrong documents. If a reindex is not done the impact will be that the issue is still seen – search queries may return wrong number of results.

Comment by Andrew Hind [X] (Inactive) [ 27-Jul-15 ]

Using the FIX action should correct any duplicate nodes.

Generated at Tue Mar 09 08:22:57 GMT 2021 using Jira 7.13.15#713015-sha1:7c5ddd2c3e1709974ae9c48c17df8edd3919fe2c.