Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 293204

with PHP 5.3.21 : includes/forms.inc throws unnecessary warning (bad in production) for forms with arrays as elements

$
0
0

Reproduction: validation of any form that has an array as a form element

Warnings should not occur in production systems, that is very bad code quality, and a major hit on the image that Drupal is trying to project as a viable CMS.

PHP 5.3.21 (may not occur with older php that does not care, however this is a coding error!)

warning thrown if a form element is an array, for that form element:

Warning: mb_strlen() expects parameter 1 to be string, array given in drupal_strlen() (line 441 of /speicher/sites/test2/includes/unicode.inc).

culprit:

includes/form.inc, function _form_validate(...):

line 1304 in includes/form.inc, within function _form_validate(.... :

// Verify that the value is not longer than #maxlength.
if (isset($elements['#maxlength']) && drupal_strlen($elements['#value']) > $elements['#maxlength']) {
form_error($elements, $t('!name cannot be longer than %max characters but is currently %length characters long.', array('!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'], '%max' => $elements['#maxlength'], '%length' => drupal_strlen($elements['#value']))));
}

this causes the warning if the array element is an array. array elements are correctly evaluated further down in the same function, and the form validation returns OK. HOWEVER: making a web site for commercial use and giving the customer something that throws a red warning when entering an item, is no good practice.

The form used is standard, none of my own: I defined a content type with nothing but a URL inside, fieldgroups enabled: that 'add content' form triggers this error.

As you see in the coding, at that point it should be checked if the element is an array, and then it should not be measured here, but further down (where it is actually done, the code is there).

Correction, found first in this posting: http://drastikbydesign.com/blog-entry/lovely-form-submission-mbstrlen-er... :

defer array processing by excluding it here:

// Verify that the value is not longer than #maxlength.
if (isset($elements['#maxlength']) && !is_array($elements['#value']) && drupal_strlen($elements['#value']) > $elements['#maxlength']) {
form_error($elements, $t('!name cannot be longer than %max characters but is currently %length characters long.', array('!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'], '%max' => $elements['#maxlength'], '%length' => drupal_strlen($elements['#value']))));
}

I did not unit test it, it removes the warning from the production site successfully, I did not verify if the code is still secure, I leave this to the experts.

It is an obvious oversight in the coding.

Mike


Viewing all articles
Browse latest Browse all 293204

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>