Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix isprivate() method. #372

Merged
merged 1 commit into from
Jun 9, 2024
Merged

Fix isprivate() method. #372

merged 1 commit into from
Jun 9, 2024

Conversation

Yousha
Copy link
Contributor

@Yousha Yousha commented Dec 24, 2023

Fix incorrect usage of the FILTER_FLAG_NO_PRIV_RANGE flag in the filter_var() function.

The FILTER_FLAG_NO_PRIV_RANGE flag is used to EXCLUDE private IP ranges. But in the code, the flag is used with the FILTER_VALIDATE_IP filter, which actually VALIDATES the IP address. As a result, the method returns the opposite result of what is intended.
So we need to change the usage of the FILTER_FLAG_NO_PRIV_RANGE flag. Instead of using it with the FILTER_VALIDATE_IP filter, we should use it with the FILTER_FLAG_NO_PRIV_RANGE flag DIRECTLY.

By using old(bugged) function we have:

echo isprivate(''); // TRUE
echo isprivate(' '); // TRUE
echo isprivate(null); // TRUE

echo isprivate('23.6.32.11'); // FALSE
echo isprivate('40.2.110.1'); // FALSE
echo isprivate('127.0.0.1'); // FALSE

echo isprivate('192.168.3.4'); // TRUE
echo isprivate('10.0.0.0'); // TRUE
echo isprivate('172.31.255.255'); // TRUE

Now by using new(fixed) function we have:

echo isprivate(''); // FALSE
echo isprivate(' '); // FALSE
echo isprivate(null); // FALSE

echo isprivate('23.6.32.11'); // FALSE
echo isprivate('40.2.110.1'); // FALSE
echo isprivate('127.0.0.1'); // FALSE

echo isprivate('192.168.3.4'); // TRUE
echo isprivate('10.0.0.0'); // TRUE
echo isprivate('172.31.255.255'); // TRUE

@KOTRET
Copy link
Contributor

KOTRET commented Dec 28, 2023

The original output is equivalent to the negated result of using FILTER_FLAG_NO_PRIV_RANGE only: php will treat null and invalid strings as private, so the "is it an ip?"-check indeed must be done separately.

As the other methods are affected as well, I'd suggest to add an isIP-method in order to combine it with the additional flags.

@KOTRET KOTRET added the bug label Dec 28, 2023
@ikkez ikkez merged commit 001e475 into f3-factory:master Jun 9, 2024
@Yousha Yousha deleted the patch-1 branch June 9, 2024 13:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants