[SOLR-4197] EDismax allows end users to use local params in q= to override global params

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5, 3.6, 4.0
• Fix Version/s: 7.2
• Assignee: Unassigned
• Reporter: Peter Wolanin
• Created: 15/Dec/12 17:24
• Updated: 27/Jun/19 01:17
• Resolved: 27/Jun/19 01:17

Description

Edismax is advertised as suitable to be used to "process advanced user input directly". Thus, it would seem reasonable to have an application directly pass user input in the q= parameter to a back-end Solr server.

However, it seems that users can enter local params at the start of q= which override the global params that the application (e.g. website) may have set on the query string. Confirmed with Erik Hatcher that this is somewhat unexpected behavior (though one could argue it's an expected feature of any query parser)

Proposed fix - add a parameter (e.g. that can be used as an invariant) that can be passed to inhibit Solr from using local params from the q= parameter.

This is somewhat related to SOLR-1687

Issue Links

• is superceded by: SOLR-11501 Depending on the parser, QParser should not parse local-params