MFH: Fixed bug #42718 (FILTER_UNSAFE_RAW not applied when configured as

default filter)

diff --git a/ext/filter/filter.c b/ext/filter/filter.c
index 1675e68dc517716f79033618b2414653f8257510..b40dc5ca46b3772b8170b8a9f9b3f1789eea9a89 100644 (file)
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@ -447,7 +447,7 @@ static unsigned int php_sapi_filter(int arg, char *var, char **val, unsigned int
                Z_STRLEN(new_var) = val_len;
                Z_TYPE(new_var) = IS_STRING;
 
-               if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)) {
+               if (IF_G(default_filter) != FILTER_UNSAFE_RAW || IF_G(default_filter_flags) != 0) {
                        zval *tmp_new_var = &new_var;
                        Z_STRVAL(new_var) = estrndup(*val, val_len);
                        INIT_PZVAL(tmp_new_var);

diff --git a/ext/filter/tests/bug42718-2.phpt b/ext/filter/tests/bug42718-2.phpt
new file mode 100644 (file)
index 0000000..fd2a91d
--- /dev/null
+++ b/ext/filter/tests/bug42718-2.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #42718 - 2 (unsafe_raw filter not applied when configured as default filter)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--INI--
+magic_quotes_gpc=1
+filter.default=unsafe_raw
+filter.default_flags=
+--GET--
+a=1%00
+--FILE--
+<?php
+echo ini_get('filter.default') . "\n";
+echo ini_get('filter.default_flags') . "\n";
+echo addcslashes($_GET['a'],"\0") . "\n";
+?>
+--EXPECT--
+unsafe_raw
+
+1\0

diff --git a/ext/filter/tests/bug42718.phpt b/ext/filter/tests/bug42718.phpt
new file mode 100644 (file)
index 0000000..2620d38
--- /dev/null
+++ b/ext/filter/tests/bug42718.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #42718 (unsafe_raw filter not applied when configured as default filter)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--INI--
+magic_quotes_gpc=0
+filter.default=unsafe_raw
+filter.default_flags=4
+--GET--
+a=1%00
+--FILE--
+<?php
+echo ini_get('filter.default') . "\n";
+echo ini_get('filter.default_flags') . "\n";
+var_dump(FILTER_FLAG_STRIP_LOW == 4);
+echo addcslashes($_GET['a'],"\0") . "\n";
+?>
+--EXPECT--
+unsafe_raw
+4
+bool(true)
+1