Page MenuHomePhabricator

Guarantee terms in PhabricatorAuthPasswordEngine are strings
ClosedPublic

Authored by epriestley on Nov 3 2020, 6:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Nov 21, 10:23 PM
Unknown Object (File)
Mon, Nov 21, 10:22 PM
Unknown Object (File)
Mon, Nov 21, 10:22 PM
Unknown Object (File)
Mon, Nov 21, 10:22 PM
Unknown Object (File)
Tue, Nov 15, 2:44 PM
Unknown Object (File)
Tue, Nov 15, 2:44 PM
Unknown Object (File)
Tue, Nov 15, 2:43 PM
Unknown Object (File)
Tue, Nov 15, 2:41 PM
Subscribers
None

Details

Summary

Ref T2312. Numeric strings are read out of arrays as integers, and modern PHP raises appropriate warnings when they're then treated as strings.

For now, cast the keys to strings explicitly (we know we inserted only strings). In the future, introduction of a StringMap type or similar might be appropriate.

Test Plan
  • Added "abc.12345.xyz" to the blocklist, changed my VCS password.
  • Before: fatal when trying to "strpos()" an integer.
  • After: password change worked correctly.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Nov 3 2020, 7:04 PM
This revision was automatically updated to reflect the committed changes.