Edit report at https://bugs.php.net/bug.php?id=81460&edit=1
ID: 81460
Comment by: ddpm at liscovius dot de
Reported by: ddpm at liscovius dot de
Summary: just a live bug test
Status: Not a bug
Type: Bug
Package: Website problem
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
You might change the title to 'better validation of input parameters of
report.php' or something like that.
I got full path with PHP8 when I change the in[passwd] to in[passwd][ooops] in
the report.php form as POST parameter in[passwd]
Better add is_string() or similiar check before passing to hash_hmac().
Fatal error: Uncaught TypeError: hash_hmac(): Argument #2 ($data) must be of
type string, array given in /var/www/html/bugs/include/functions.php:1692 Stack
trace: #0 /var/www/html/bugs/include/functions.php(1692): hash_hmac() #1
/var/www/html/bugs/www/report.php(224): bugs_get_hash() #2 {main} thrown in
/var/www/html/bugs/include/functions.php on line 1692
Also spits 'Warning: Undefined array key "package_name" in
/var/www/html/bugs/www/report.php on line 70' when I submit form without
selecting a package_name on local dev engine with PHP8.0.10
Previous Comments:
------------------------------------------------------------------------
[2021-09-23 12:41:32] ni...@php.net
Assuming this is no longer needed...
------------------------------------------------------------------------
[2021-09-20 07:59:36] c...@php.net
> I assume bugs.php.net uses an older version or suppresses
> errors.
Likely both.
> will do github PR if verified.
Would be welcome anyway.
------------------------------------------------------------------------
[2021-09-19 22:55:26] ddpm at liscovius dot de
Seems ok here. I used PHP8.1RC2 on my dev box.
I assume bugs.php.net uses an older version or suppresses errors.
------------------------------------------------------------------------
[2021-09-19 22:51:31] ddpm at liscovius dot de
Description:
------------
Just trying if a bug appears also on live system.
Triggered it on my dev environment.
Test script:
---------------
will do github PR if verified.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81460&edit=1
--
PHP Webmaster List Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
