Bug #14394
closedPHP error in CSRF Magic from invalid time value
100%
Description
[08-May-2023 10:36:37 Europe/Warsaw] PHP Fatal error: Uncaught TypeError: Unsupported operand types: string + int in /usr/local/www/csrf/csrf-magic.php:307 Stack trace: #0 /usr/local/www/csrf/csrf-magic.php(293): csrf_check_token('' eval(compile(...') #1 /usr/local/www/csrf/csrf-magic.php(197): csrf_check_tokens(Array) #2 /usr/local/www/csrf/csrf-magic.php(408): csrf_check() #3 /usr/local/www/guiconfig.inc(48): require_once('/usr/local/www/...') #4 /usr/local/www/index.php(46): require_once('/usr/local/www/...') #5 {main} thrown in /usr/local/www/csrf/csrf-magic.php on line 307
Updated by Jim Pingle about 1 year ago
- Subject changed from PHP Fatal error: Uncaught TypeError: Unsupported operand types: string + int in /usr/local/www/csrf/csrf-magic.php:307 to PHP error in CSRF Magic
- Description updated (diff)
- Target version set to 2.7.0
- Plus Target Version set to 23.09
This specific error appears to possibly come from bad/corrupted cookie data from the client. It's trying to extract a timestamp but not getting anything that casts to an integer automatically. We could work around the error by casting the variables involved on that line to (int)
if nothing else as a safety measure.
There are also some PHP 8 style issues in the CSRF Magic code that should be taken care of. Not sure if there is an upstream update or if it's all our own code to maintain there.
Updated by Jim Pingle about 1 year ago
- Target version changed from 2.7.0 to CE-Next
Updated by Jim Pingle 12 months ago
- Assignee set to Jim Pingle
- Target version changed from CE-Next to 2.8.0
Updated by Jim Pingle 12 months ago
- Subject changed from PHP error in CSRF Magic to PHP error in CSRF Magic from invalid time value
Updated by Jim Pingle 12 months ago
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Applied in changeset 1a57545864783b3acc5f28d166a79bd92a849759.
Updated by Danilo Zrenjanin 12 months ago
- Status changed from Feedback to Resolved
The issue occurred only once on a customer's appliance and has not been reported by anyone else yet.
The patch minimizes the likelihood of encountering a previously difficult-to-reproduce problem.
I am marking this ticket as resolved.