Skip to content

Commit 5d63c55

Browse files
committed
bug symfony#17287 [HttpKernel] Forcing string comparison on query parameters sort in UriSigner (Tim van Densen)
This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes symfony#17287). Discussion ---------- [HttpKernel] Forcing string comparison on query parameters sort in UriSigner | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | The signing of an url fails when using query parameters with integers as keys. The ksort function in the ```UriSigner``` class changes the order of the query params and causes to generate a different hash which results in a failed check. In this PR we force a string comparison for ksort which keeps the correct order of parameters. Commits ------- 2040139 Added sort order SORT_STRING for params in UriSigner
2 parents f9bf3f8 + 2040139 commit 5d63c55

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed

src/Symfony/Component/HttpKernel/Tests/UriSignerTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ public function testCheck()
3333

3434
$this->assertTrue($signer->check($signer->sign('http://example.com/foo')));
3535
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar')));
36+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer')));
3637

3738
$this->assertTrue($signer->sign('http://example.com/foo?foo=bar&bar=foo') === $signer->sign('http://example.com/foo?bar=foo&foo=bar'));
3839
}

src/Symfony/Component/HttpKernel/UriSigner.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ private function computeHash($uri)
9191

9292
private function buildUrl(array $url, array $params = array())
9393
{
94-
ksort($params);
95-
$url['query'] = http_build_query($params);
94+
ksort($params, SORT_STRING);
95+
$url['query'] = http_build_query($params, '', '&');
9696

9797
$scheme = isset($url['scheme']) ? $url['scheme'].'://' : '';
9898
$host = isset($url['host']) ? $url['host'] : '';

0 commit comments

Comments
 (0)