Shardj / zf1-future

PHP 8.1 compatible version of ZF1
BSD 3-Clause "New" or "Revised" License
442 stars 196 forks source link

Implementation of Zend_Cache_Backend_TwoLevels::_getFastLifetime is incorrect. #423

Open ragnese opened 5 months ago

ragnese commented 5 months ago

Link: https://github.com/Shardj/zf1-future/blob/b87c1507cd10c01d9b3b1bc4a0cae32f6a9c6d6c/library/Zend/Cache/Backend/TwoLevels.php#L520

I discovered this issue in a project of ours that is using an ancient version of the original Zend_* stuff (before zf1-future existed), and it looks like it carried all the way over to today without being caught/fixed.

The problem is with how this method is called in the save method: https://github.com/Shardj/zf1-future/blob/b87c1507cd10c01d9b3b1bc4a0cae32f6a9c6d6c/library/Zend/Cache/Backend/TwoLevels.php#L206.

It's called with the default argument for $maxLifetime, which is null. The problem is that _getFastLifetime will always return null when $maxLifetime is null. This is because, if ($maxLifetime >= 0 && $fastLifetime > $maxLifetime) will always evaluate to true when $maxLifetime is null, and will therefore return $maxLifetime (null).

So the fast cache values are always being inserted with no lifetime/TTL and will never expire.