sb3108sa / phpbrowscap

Automatically exported from code.google.com/p/phpbrowscap
GNU Lesser General Public License v2.1
0 stars 0 forks source link

Existence of curl extension not checked in _getRemoteData() - curl-functions might be called because of switch/case-fallthrough #3

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. Make sure curl-extension is not loaded (php.ini)
2. Block access to update site (disconnect from internet or whatever)

What is the expected output? What do you see instead?
A Browscap_Exception should be thrown - instead a fatal error "Call to
undefined function curl_init()" is raised. Very inconvenient, because the
whole script is terminated as there is no means of catching a fatal error
and continue execution.

While _getUpdateMethod() checks for extension_loaded('curl') before setting
the update method to curl, the switch/case statement in _getRemoteData()
just falls through to the curl-related part if everything else fails.

What version of the product are you using? On what operating system?
The currently downloadable Browscap-php5-r10 - called version 0.7 in the
source, though (no mention of r10). Problem affects all OS and PHP versions.

Please provide any additional information below.
Is seems that browsers.garykeith.com started blocking phpbrowscap by user
agent string!? I can access the update URLs manually by Browser, but the
phpbrowscap-class get a 403 access denied HTTP-response.
If I change the value of the classes $userAgent-property to something other
than 'PHP Browser Capabilities Project/%v %m', it works fine!

Original issue reported on code.google.com by google@imbt.de on 23 Dec 2008 at 4:11

GoogleCodeExporter commented 8 years ago
Thanks for reporting, I'll correct this in the next days, along with the UA 
related issue.

The second one is due to someone which abused of the auto update capabilities 
and setted the update interval 
too low (10 seconds). Gary Keith ended up blocking all requests with this UA 
and thus all users using my script 
without changing the UA.

Original comment by st.jonat...@gmail.com on 23 Dec 2008 at 4:24