akeeba / fof

Rapid Application Development framework for Joomla!™ 3 and 4
0 stars 0 forks source link

Problem bigINT in libraries/filter/input.php #646

Closed Mika17420 closed 7 years ago

Mika17420 commented 7 years ago
    // Handle the type constraint cases
    switch (strtoupper($type))
    {
        case 'INT':
            if ($source>PHP_INT_MAX && !is_array($source)) // 2147483647 in 32 bits
            {       
                $result = $source;
                break;
            }   
        case 'INTEGER':
            $pattern = '/[-+]?[0-9]+/';
nikosdion commented 7 years ago

If you expect to handle integers larger than PHP's PHP_INT_MAX (2^7 - 1 for anything except 64-bit Linux, 2^63 - 1 for 64-bit Linux) you should not use the built in filters. Instead, I recommend getting it as string and then doing your own filtering.

Also note that you are talking about FOF 2 which is END OF LIFE since May 2016 and will never, ever, receive any changes any more. FOF 3 simply extends JInput and defers filtering to Joomla itself, therefore there is nothing to change.

Mika17420 commented 7 years ago
Hello Nicholas,
  Thank you for the answer i'm using FOF3.
  The problem is that my custumer use windows 32bit with Wamp. 
  I have made modification in libraries/joomla/filter/input.php 
              case 'INT':
                  if ($source>PHP_INT_MAX &&
  !is_array($source)) // 2147483647 in 32 bits
                  {        
                      $result = $source;
                      break;
                  }
Now it works.
  But the next update of joomla, the changes will disappear.
  Do you have an idea ?
    thank's

Le 27/01/2017 à 12:28, Nicholas K.
  Dionysopoulos a écrit :

  If you expect to handle integers larger than PHP's PHP_INT_MAX
    (2^7 - 1 for anything except 64-bit Linux, 2^63 - 1 for 64-bit
    Linux) you should not use the built in filters. Instead, I
    recommend getting it as string and then doing your own
    filtering.
  Also note that you are talking about FOF 2 which is END
      OF LIFE since May 2016 and will never, ever, receive
    any changes any more. FOF 3 simply extends JInput and defers
    filtering to Joomla itself, therefore there is nothing to
    change.
  —
    You are receiving this because you authored the thread.
    Reply to this email directly, view
      it on GitHub, or mute
      the thread.

  {"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/akeeba/fof","title":"akeeba/fof","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/akeeba/fof"}},"updates":{"snippets":[{"icon":"PERSON","message":"@nikosdion in #646: If you expect to handle integers larger than PHP's PHP_INT_MAX (2^7 - 1 for anything except 64-bit Linux, 2^63 - 1 for 64-bit Linux) you should not use the built in filters. Instead, I recommend getting it as string and then doing your own filtering.\r\n\r\nAlso note that you are talking about FOF 2 which is **END OF LIFE** since May 2016 and will never, ever, receive any changes any more. FOF 3 simply extends JInput and defers filtering to Joomla itself, therefore there is nothing to change."}],"action":{"name":"View Issue","url":"https://github.com/akeeba/fof/issues/646#issuecomment-275645539"}}}

  -- 
      Mickaël NAPPÉE
      Support Technique

    Joignable
            le Lundi de 14h00 à 18h00
            et du Mardi au Vendredi
            de 8h30 à 12h00 et de 14h00 à 18h00
            Tél. 05 46 39 82 72, choix 1
            Fax 03 87 70 83 44
nikosdion commented 7 years ago

Some points for you to consider and repent.

  1. You have modified core Joomla! files. You have mathematically led to your client's site being hacked. Your code only works with MODIFIED core Joomla library code. As such, your client will never be able to install Joomla updates. As soon as there is a security issue in Joomla your client is completely screwed: installing the update will break his site and not installing the update will get his site hacked.

  2. I already told you how to do it right and you ignored me. Get the big integer as string. Since it's a big integer you are processing it as string anyway (otherwise it'd overflow PHP's intrinsic integer type). Then you can run your custom filters on it. Bonus points: this doesn't require you to modify Joomla. Remember: only utter and complete idiots modify Joomla core files. You do not want to be an utter and complete idiot, now, do you?

  3. You are filing an issue in FOF 3 about a change you made in core Joomla. What exactly do you expect me to do? Have FOF 3 hack the bloody Joomla core files like I am some kind of masturbating bonobo? Or do you really can't tell FOF and Joomla apart?

You're lucky you are not my employee. You'd have been fired on the spot. Now go and fix the stupid mistakes you did on your client's site.

Mika17420 commented 7 years ago
My god no I am not
      modifying the site of my client ...
    I do a local test before taking advantage of it. I
      heard you the first time and therefore done as you have
      indicated. It only remains for me to redo my
      query of research because of the blow it does not work any
      more at all the same. For sure I take all the
      advice that is to be taken and I learn. I'm just
      beginning to developement. I simply
      informed qualified people that for joomla there could be a
      problem for customers in 32bit under windows to read bigINT
      can be that you as expert you have your relations with these
      people there.

Le 27/01/2017 à 14:18, Nicholas K.
  Dionysopoulos a écrit :

Some points for you to consider and repent.

  1. You have modified core Joomla! files. You have mathematically
  led to your client's site being hacked. Your code only works with
  MODIFIED core Joomla library code. As such, your client will never
  be able to install Joomla updates. As soon as there is a security
  issue in Joomla your client is completely screwed: installing the
  update will break his site and not installing the update will get
  his site hacked.

  2. I already told you how to do it right and you ignored me. Get
  the big integer as string. Since it's a big integer you are
  processing it as string anyway (otherwise it'd overflow PHP's
  intrinsic integer type). Then you can run your custom filters on
  it. Bonus points: this doesn't require you to modify Joomla.
  Remember: only utter and complete idiots modify Joomla core files.
  You do not want to be an utter and complete idiot, now, do you?

  3. You are filing an issue in FOF 3 about a change you made in
  core Joomla. What exactly do you expect me to do? Have FOF 3 hack
  the bloody Joomla core files like I am some kind of masturbating
  bonobo? Or do you really can't tell FOF and Joomla apart?

  You're lucky you are not my employee. You'd have been fired on the
  spot. Now go and fix the stupid mistakes you did on your client's
  site.

  -- 
      Mickaël NAPPÉE
      Support Technique

    Joignable
            le Lundi de 14h00 à 18h00
            et du Mardi au Vendredi
            de 8h30 à 12h00 et de 14h00 à 18h00
            Tél. 05 46 39 82 72, choix 1
            Fax 03 87 70 83 44
Eighke commented 7 years ago

He forgot to tell you: this is the primary key (auto increment) of the table. ;)

Mika17420 commented 7 years ago
Well it's not realy auto increment cause i make my own update in
  table

Le 01/02/2017 à 12:29, Eighke a écrit :

  He forgot to tell you: this is the primary key (auto increment)
    of the table. ;)
  —
    You are receiving this because you authored the thread.
    Reply to this email directly, view
      it on GitHub, or mute
      the thread.

  {"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/akeeba/fof","title":"akeeba/fof","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/akeeba/fof"}},"updates":{"snippets":[{"icon":"PERSON","message":"@Eighke in #646: He forgot to tell you: this is the primary key (auto increment) of the table. ;)"}],"action":{"name":"View Issue","url":"https://github.com/akeeba/fof/issues/646#issuecomment-276635031"}}}

  -- 
      Mickaël NAPPÉE
      Support Technique

    Joignable
            le Lundi de 14h00 à 18h00
            et du Mardi au Vendredi
            de 8h30 à 12h00 et de 14h00 à 18h00
            Tél. 05 46 39 82 72, choix 1
            Fax 03 87 70 83 44