0013303: File attachments cannot be uploaded when PHP's "file_uploads" configuration directive equals "On" - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update
0013303	mantisbt	attachments	public	2011-09-12 10:57	2014-09-23 18:05

Reporter	cbj4074	Assigned To	dregad
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	1.2.5
Target Version	1.2.9	Fixed in Version	1.2.9

Summary	0013303: File attachments cannot be uploaded when PHP's "file_uploads" configuration directive equals "On"
Description	If PHP's "file_uploads" configuration directive is "On" (with an uppercase "O"), as opposed to "on" (with a lowercase "o"), file attachment uploading is not possible in Mantis.
Steps To Reproduce	Set PHP's "file_uploads" configuration directive to "On" (as opposed to "on").
Additional Information	The root cause of this issue resides in the ini_get_bool() function (/core/utility_api.php). The various case statements do not account for the possibility that PHP's file_uploads directive is defined with an uppercase "O" in "On". Rather than add a new case for every possible, e.g., case 'on': case 'On': case 'ON': a better solution would be to perform case-insensitive string comparisons where appropriate.
Tags	No tags attached.
Attached Files	0001-Fix-13303-use-strtolower-in-ini_get_bool.patch (853 bytes) From 0b2fb6aaab907d79efff6548395c1f79c6948346 Mon Sep 17 00:00:00 2001 From: Damien Regad <damien.regad@merckgroup.com> Date: Wed, 14 Sep 2011 09:54:48 +0200 Subject: [PATCH] Fix #13303: use strtolower in ini_get_bool() In some cases, ini_get returns the actual config option string instead of "0"/"1", which causes the wrong value to be returned e.g. when the option is set to "On". --- core/utility_api.php \| 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/core/utility_api.php b/core/utility_api.php index cb4d372..45aa44c 100644 --- a/core/utility_api.php +++ b/core/utility_api.php @@ -81,7 +81,7 @@ function ini_get_bool( $p_name ) { $result = ini_get( $p_name ); if( is_string( $result ) ) { - switch( $result ) { + switch( strtolower( $result ) ) { case 'off': case 'false': case 'no': -- 1.7.4.1 0001-Fix-13303-use-strtolower-in-ini_get_bool.patch (853 bytes)

dregad 2011-09-14 04:10 developer ~0029706	Please test the attached patch - I can't do it here, because ini_get always returns "0" or "1" for me, regardless the of the case in php.ini

dregad 2011-09-14 07:54 developer ~0029708	Don't worry about testing, I managed to replicate the behavior by setting the option with php_admin_value in httpd.conf.

grangeway 2013-04-05 17:57 reporter ~0036320	Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch

MantisBT: master-1.2.x c6ad34e5 2011-09-14 00:48 dregad Details Diff	Fix 0013303: use strtolower in ini_get_bool() Generally, ini_get() returns '0' or '1' when querying a boolean option, regardless of the actual string used to set it (i.e. On, False, etc). However, in some cases (e.g. when the option is set in httpd.conf via php_admin_value instead of php_admin_flag), ini_get() returns the string itself instead. This caused ini_get_bool() to wrongly return False when the option is set to an equivalent of True but with a different case ('On', 'TRUE').		Affected Issues 0013303
	mod - core/utility_api.php		Diff File
MantisBT: master a6662375 2011-09-14 00:48 dregad Details Diff	Fix 0013303: use strtolower in ini_get_bool() Generally, ini_get() returns '0' or '1' when querying a boolean option, regardless of the actual string used to set it (i.e. On, False, etc). However, in some cases (e.g. when the option is set in httpd.conf via php_admin_value instead of php_admin_flag), ini_get() returns the string itself instead. This caused ini_get_bool() to wrongly return False when the option is set to an equivalent of True but with a different case ('On', 'TRUE').		Affected Issues 0013303
	mod - core/utility_api.php		Diff File