Fix ColleagueResponse.find(): string identity comparisons and unbound :subjectAbbvs parameter - #2
Open
tarekabiramia wants to merge 2 commits into
Open
Conversation
added 2 commits
September 1, 2026 11:15
…Response.find()
Empty filter fields on the Colleague Message Responses screen are stored in
the HTTP session as "" (the form only clears attributes when null), and
`x != ""` compares object references — true for any runtime empty string.
The query then gains predicates like upper(courseNumber) = upper('') and
the screen shows zero rows until the user starts a new HTTP session.
All 8 sites (4 whereHql builders + 4 setParameter guards) change together,
otherwise Hibernate throws on a parameter/query mismatch.
The query builder unconditionally appended "rp.subjectCode in :subjectAbbvs",
but the binder only calls setParameterList when the list is non-empty.
Administrators get an empty subjects set from the action, so the clause was
added with nothing bound and Hibernate threw QueryParameterException
(':subjectAbbvs'). Guard the builder with the same emptiness condition the
binder uses — admins get no subject restriction (they see everything),
non-admins keep their scoping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small bug fixes in
ColleagueAddOn/JavaSource/org/unitime/colleague/model/ColleagueResponse.java, both hit on the Colleague Message Responses screen (UniTime 4.9 + Colleague add-on on Tomcat 10.1, MySQL).1.
!= ""string identity comparisons make empty filters behave as real filtersfind()guards its optional filters withx != "". That compares object references, and the filter values coming back from the HTTP session are runtime-constructed empty strings (the form only clears session attributes when the value is null), so the guard is true for empty input. The query then gains predicates likeupper(rp.courseNumber) = upper('')and the screen returns zero rows until the user starts a fresh HTTP session.Fixed by replacing the identity comparisons with
!x.isEmpty()at all 8 sites the 4whereHqlbuilders and the 4 matchingsetParameterguards must change together, otherwise Hibernate throws on a parameter/query mismatch.2.
:subjectAbbvspredicate appended even when no subject list is boundThe query builder unconditionally appends
rp.subjectCode in :subjectAbbvs, but the binder only callssetParameterListwhen the subject list is non-empty. Administrators reachfind()with an empty subject set, so the clause was added with nothing bound and Hibernate threwQueryParameterException: could not locate named parameter [subjectAbbvs].Fixed by guarding the builder with the same emptiness condition the binder uses: admins get no subject restriction (they see all rows), non-admin users keep their subject-area scoping.