Page MenuHomePhabricator
Create Task
Maniphest T29376

when using ApiBase::PARAM_TYPE => 'integer' without a min or max value, api doesn't validate the input is actually an integer
Closed, ResolvedPublic
Actions

Description

Version: 1.18.x
Severity: enhancement

Details

Reference
bz27376

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:15 PM
• bzimport added a project: MediaWiki-Action-API.
• bzimport set Reference to bz27376.
Bawolff created this task.Feb 13 2011, 7:33 AM
Bawolff added a comment.Feb 13 2011, 7:36 AM

oops, hit enter by accident.

When you specify a parameter to an api module is an integer with ApiBase::PARAM_TYPE => 'integer', but don't list a max or min value, the api doesn't seem to check its actually an integer. Expected behaviour would be for it to pass the value through intval to turn it into an integer, like it does if a min or max is specified.

Reedy added a comment.Feb 13 2011, 5:01 PM

r82060

Reedy added a comment.Feb 13 2011, 5:01 PM

Test

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL