Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

CHttpRequest::stripSlashes() does not modify array keys #2023

Closed
etienneq opened this Issue Jan 22, 2013 · 1 comment

Comments

2 participants
Contributor

etienneq commented Jan 22, 2013

If magic_quotes is enabled stripSlashes() modifies all array values of $_GET, $_POST etc.

When using namespaced form models array keys look like that:

$_POST['my\namespace\formmodel'] = array('a' => 1, 'b' => 2, ...);

With magic_quotes $_POST now looks like that:

$_POST['my\\namespace\\formmodel'] = array('a' => 1, 'b' => 2, ...);

Because the array key of my form ID is now wrong, the POST will not be detected in controller action and can not be processed.

I will provide a pull request shortly to modify array keys as well.

Cheers
Etienne

Owner

cebe commented Feb 13, 2013

You should turn off magic_quotes_gpc as it is deprecated as of php 5.3 and removd in 5.4:
http://www.php.net/manual/en/security.magicquotes.php

But thanks for reporting and fixing.

@cebe cebe closed this Feb 13, 2013

@cebe cebe was assigned Feb 13, 2013

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment