cubecart / v6

CubeCart Version 6
https://cubecart.com
72 stars 59 forks source link

Bugfix: `ltrim()` trims too many characters from 404 log URLs #3443

Closed blimpage closed 8 months ago

blimpage commented 9 months ago

Rather than removing instances of an entire search string from the supplied input string, ltrim() removes all characters from the input string that appear anywhere in the search string, until it finds the first character in the input string that doesn't appear in the search string.

When used here in adding URLs to the 404 log table, this means that sometimes additional parts of the URL's path will be removed, depending on your site's CC_ROOT_REL.

For example, with the URL https://example-site.com/online-store/index.php, the site's CC_ROOT_REL will be /online-store/, so ltrim() will trim the URL to dex.php since the i and n characters at the start of the path appear in CC_ROOT_REL. d does not appear in CC_ROOT_REL, so all characters from that point on are preserved.

Using preg_replace() instead ensures that only the exact CC_ROOT_REL string is removed from the beginning of the logged URL.

Related

There's another use of ltrim() in settings.language.inc.php that looks like it also might trim URLs too aggressively, but I'm not familiar with the context of that code so I haven't touched it here.

blimpage commented 9 months ago

Just pushed an update: this fix originally used str_replace(), but I realised that this would also remove too many characters from the path in edge cases where CC_ROOT_REL happens to appear in the path multiple times. I've updated this now to use a regex replacement anchored to the start of the string, so it should only remove CC_ROOT_REL when it appears at the very start of the path.

abrookbanks commented 8 months ago

Thanks so much for this.