Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 298686

Requesting a page with ?page[foo]=bla results in a fatal error on PHP 8+

$
0
0

Problem/Motivation

The code assumes that page is a string, passing in an array results in a warning on PHP 7 and a fatal error on PHP 8. We discovered this because a security scanner on one of our websites triggered a lot of those errors.

Steps to reproduce

Visit /node?page[foo]=bla:

The website encountered an unexpected error. Please try again later.
TypeError: explode(): Argument #2 ($string) must be of type string, array given in explode() (line 58 of core/lib/Drupal/Core/Pager/PagerParameters.php).

explode() (Line: 58)
Drupal\Core\Pager\PagerParameters->getPagerQuery() (Line: 49)
Drupal\Core\Pager\PagerParameters->findPage() (Line: 304)
Drupal\views\Plugin\views\pager\SqlBase->setCurrentPage() (Line: 929)
Drupal\views\ViewExecutable->initPager() (Line: 1444)
Drupal\views\Plugin\views\query\Sql->build() (Line: 1321)
Drupal\views\ViewExecutable->build() (Line: 392)

Proposed resolution

Ignore non-string page query parameters.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet


Viewing all articles
Browse latest Browse all 298686


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>