diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #17287 [HttpKernel] Forcing string comparison on query parameters sort in UriSigner (Tim van Densen) 

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #17287).

Discussion
----------

[HttpKernel] Forcing string comparison on query parameters sort in UriSigner

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The signing of an url fails when using query parameters with integers as keys.
The ksort function in the ```UriSigner``` class changes the order of the query params and causes to generate a different hash which results in a failed check.

In this PR we force a string comparison for ksort which keeps the correct order of parameters.

Commits
-------

2040139 Added sort order SORT_STRING for params in UriSigner
This commit is contained in:
Fabien Potencier 2016-01-07 14:44:10 +01:00
parent f9bf3f8d5a 2040139db6
commit 5d63c554e8
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/Symfony/Component/HttpKernel/Tests/UriSignerTest.php
View File

@ -33,6 +33,7 @@ class UriSignerTest extends \PHPUnit_Framework_TestCase
$this->assertTrue($signer->check($signer->sign('http://example.com/foo')));
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar')));
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer')));
$this->assertTrue($signer->sign('http://example.com/foo?foo=bar&bar=foo') === $signer->sign('http://example.com/foo?bar=foo&foo=bar'));
}

4
src/Symfony/Component/HttpKernel/UriSigner.php
View File

@ -91,8 +91,8 @@ class UriSigner
private function buildUrl(array $url, array $params = array())
{
ksort($params);
$url['query'] = http_build_query($params);
ksort($params, SORT_STRING);
$url['query'] = http_build_query($params, '', '&');
$scheme = isset($url['scheme']) ? $url['scheme'].'://' : '';
$host = isset($url['host']) ? $url['host'] : '';