Glpi: Error Search KB using GLPI API

[augustoferronato]

When i try to search a article on KB using API i have an SQL Syntax error.

The search:
curl -X GET -H 'Content-Type: application/json' -H "Session-Token: fdffdfdf" -H "App-Token: sdfsdfsfsdfsfdsfd" 'http://glpi.example.com/apirest.php/search/Knowbaseitem?\criteria=\[0\]\[field\]\=6\&criteria\[0\]\[searchtype\]=contains\&criteria\[0\]\[value\]=Portal'

I receive the error:
["ERROR_SQL","Unexpected SQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BYid' at line 2"](venv)

Here the sql-errors.log

Error log sql-errors.log

tail -f ./files/_log/sql-errors.log

* MySQL query error:
SQL: SELECT \'glpi\' AS currentuser,
glpi_knowbaseitems.id AS id FROM glpi_knowbaseitems WHERE ( ) ORDER BY id
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BY id' at line 2
Backtrace :
inc/search.class.php:921
inc/search.class.php:116 Search::constructDatas()
inc/api.class.php:1334 Search::getDatas()
inc/apirest.class.php:168 API->searchItems()
apirest.php:47 APIRest->call()

[btry]

Hi

I add a note : you said the bug occurs with GLPI 9.1.3.

I think your issue comes from your request being malformed. I noticed several problems

• remove the backslash before the first occurence of "criteria"
• remove the equal sign after the first occurrence of "criteria"
• remove the backslashes before the "&" separator

The request should look like this.

curl -X GET -H 'Content-Type: application/json' -H "Session-Token: fdffdfdf" -H "App-Token: sdfsdfsfsdfsfdsfd" 'http://glpi.example.com/apirest.php/search/Knowbaseitem?criteria\[0\]\[field\]\=6&criteria\[0\]\[searchtype\]=contains&criteria\[0\]\[value\]=Portal'

You enclosed the URL between single quotes, but in the documentation it is enclosed between double quotes. I guess this affected the need to escape some chars.

I guess you copied the backslash following the question mark from the documentation, but it is intended to mark continuation of the command in the next line (it sould be prefixed by a white space, as we can see in lines describing headers).

All these extra chars prevented the search engine to receive some parameters you gave.

Maybe the API should count the quantity of

• fields
• searchtype
• values

and ensure these counts are the same as a sanity check.

[mtulio]

@btry is there an way to send the search criteria in HTTP GET header, like in cURL bellow?

curl -X GET -H 'Content-Type: application/json'\
 -H "Session-Token: ${GLPI_SESSION}"\
 -H "App-Token: ${GLPI_API}"\
 -H '{"criteria": [ {"field":6,"searchtype":"contains","value":"Portal"] }'\
 'http://${GLPI_API_REST}/search/Knowbaseitem'

[btry]

Hi @mtulio

The current implementation of the API does not allows passing criterias from HTTP headers. You must use the query string.

If you have a use case which justifies this form of request, please open a ticket to ask for the feature with a description of your use case.

[btry]

I said the doc would need an update, but I changed my mind : adding spaces before some backslashes would insert these spaces in the query string if the example is copy pasted.

The issue is fixed, then I close.

[trasher]

Just a note: this is fixed in the 9.1/bugfixes branch (9.1.3 release); but not yet fixed in master (see #2095 ).

[trasher]

Changes have been reverted; since the issue is not really fixed everywhere.

[btry]

2104 is a bit stronger than #2095 when sarching with XMLRPC now.

[trasher]

I think this one is fixed now.