Incorrect Type check in Groups generates extremely long SQL query

[comminski]

If you have a site with a large group of users and you go to A BP Group and select Manage > Members, it triggers a sql query to return the list of members

On line 402 of buddypress/bp-core/classes/class-bp-user-query.php, there is a boolean check false !== $search_terms. For this query, $search_terms is null, not False, so the SQL query generates a AND u.ID IN statement with every user_id in the database.

This is causing an issue on WP Engine where the query can be so long, that it is Killed.

[r-a-y]

Thanks for the report, @comminski.

I can't verify that $search_terms is null; it's always false for me. Are you perhaps running a plugin that adds a search form to a group's "Manage > Members" page?

[imath]

@comminski thanks for reporting this issue. Could you also tell us what’s the BP Template pack you activated in Settings / BuddyPress / Options ? We are using the BP REST API in BP Nouveau while we don’t in BP Legacy.

[comminski]

Hi, thank you for looking into this, here is more detail on how to reproduce this:

• I am using the Nouveau template
• BuddyPress 5.1.2 (upgraded to 6.0.0 and experienced the same issue)
• WordPress version 5.4.1
• WordPress Theme: Twenty Nineteen
• Tested in Chrome 81.0 & Firefox 75.0
• BuddyPress was the only active plugin on the site

I created a new Private group called Test
I added var_dump($search_terms); die(); to line 400 of buddypress/bp-core/classes/class-bp-user-query.php
I visited the manage-members area at wordpress.lcl/groups/test/admin/manage-members/
I found $search_terms was null, not false

[imath]

Thanks for these details @comminski. As @r-a-y checked everywhere in BP Core, I believe the issue is located into the BP REST API (which is maintained on GitHub). So far if there are no search terms, NULL is used as the fallback value.

I've created this ​PR on its GitHub repository to fix this issue asap.

[comminski]

Awesome, thanks for the fast response.

[imath]

It has been fixed into the BP REST API.

See [12658] for more details about it.