joomla-framework / input Goto Github PK

The latest version 1.2.1 totally breaks how Input works.

In all the class constructors (Input, Cookie, File, etc.) the $source variable in the constructor was changed from a default of null to an empty array().

However, the $_REQUEST variables are only loaded if $source is null still. Which means instantiating any input class as designed and documented, like: new Input\Input results in the class having an empty data array, instead of being populated with the $_REQUEST variables. So nothing ends up working anymore.

The end users have to change their code, like now having to do new Input\Input(null) to work, but this update is not supposed to be a BC breaking update so, really, the Input class constructors need to change their check on the $source variable from is_null() to is_array()

At line https://github.com/joomla-framework/input/blob/master/src/Input.php#L318 we are loading all inputs and at line https://github.com/joomla-framework/input/blob/master/src/Input.php#L326 we are serializing inputs, which in turn calls again serialize of Joomla\Input::serialize.

Same case with desiralize & CliInput.

This has been copied over from joomla/framework.joomla.org#77 from @smohila since it was wrong in the framework.joomla.org project.

As a follow up to joomla/joomla-cms#35684 I would like to place this issue here:

Steps to reproduce the issue

• Set up a path with a space character in the $config->tmp_path variable (e.g. /Users/test/files/joomla projects/mysite/tmp)
• Start a joomla update in the joomla backend

Expected result

The joomla update process should run through as normal (update from 3.9.27 to 3.10.2).

Actual result

Update could not be installed. Got an error The checksum verification failed. Please make sure you are using the correct update server!.

Reason for this error

In file libraries/vendor/joomla/filter/src/InputFilter.php in method cleanPath (line 1017) a regexp for checking the path for Linux or Windows file systems fails. For Linux systems the patters is defined as:

$linuxPattern = '/^[A-Za-z0-9_\/-]+[A-Za-z0-9_\.-]*([\\\\\/]+[A-Za-z0-9_-]+[A-Za-z0-9_\.-]*)*$/';

This pattern does not accept any spaces. Thus a tmp_path containing any spaces will fail.

Solution

The pattern should allow space, e.g.

$linuxPattern = '/^[A-Za-z0-9 _\/-]+[A-Za-z0-9 _\.-]*([\\\\\/]+[A-Za-z0-9 _-]+[A-Za-z0-9 _\.-]*)*$/';

Then the method cleanPath will return the correct path and the update process works as expected.

Additional comments

Tested/reproduced on Joomla! 3.9.27 trying to update to 3.10.2