Bug in JRouterSite::_parseRawRoute, incorrectly checking the URI for Itemid

[Oli Griffiths]

Hi All (again)


I believe ive unearthed a bug in the uri handling of 1.5 when posting to index.php.

The problem is as follows.

I have 2 menu items

ID: 1 = option=com_user&view=login&Itemid=1
ID: 2 = option=com_mycomponent&Itemid=2

The default menu item for the site is Itemid=1.

Im posting data with a different Itemid (2) to index.php.

In the route() function of Japplication ($mainframe) the URI is created, based off the server uri /var/www/XXXXX/httpdocs/index.php

This part is correct. The problem comes with the parse() method within the router.

Within the parse function (/includes/router.php L:126) $this->_parseRawRoute is called (the URI is passed to this function), which is there to detect if an option / Itemid is set, and if not, load up the default URL from the menu table (1).

The problem is that when using the URI, the Itemid is never set when POSTING to index.php, so the function thinks you are accessing the index page with no query string, thus no Itemid, and loads the default url (1) which then gets merged with the existing request array.
Producing:
$_REQUEST = Array{
option=com_mycomponent
view=login
task=save
itemid=2
}

I believe this method should be checking Jrequest for these variables NOT the URI, the request var would then contain
$_REQUEST = Array{
option=com_mycomponent
task=save
itemid=2
}

As I was posting just OPTION and TASK the view was being set to LOGIN (as this is the VIEW for the default menu item) and my application was complaining that the view Login did not exist (which it didn’t) yet because the _parseRawRoute method was using the URI instead of Jrequest it was loading up the default menu Item and setting the view.

I hope that all makes sense, there is a simple fix:

/includes/router.php L:121

if(!$uri->getVar('Itemid') && !$uri->getVar('option'))

To

if(!JRequest::getVar('Itemid') && !JRequest::getVar('option'))

This solves the problem as we are checking the request array which contains my Itemid and not the URI

Hope someone can verify this.

Oli

[Ryan W. Ozimek]

Oli,

 

Nice bug hunting there!  This definitely sounds like patch material to my untrained eye.  Can you post this to the bug tracker?

Cheers,

Ryan

---

From: joomla-de...@googlegroups.com [mailto:joomla-de...@googlegroups.com] On Behalf Of Oli Griffiths
Sent: Thursday, May 21, 2009 10:04 AM
To: joomla-de...@googlegroups.com
Subject: Bug in JRouterSite::_parseRawRoute, incorrectly checking the URI for Itemid

[Mr Phil E. Taylor]

(Sorry for cross posting to both lists - but this "bug" is important to 3PD)

You the man!

I posted the problem description to joomla-dev-cms mailing list on
15/04/09 16:21 but no one even answered (Apart from AmyS!)

This is the answer I needed - thanks for finding the lines I need to
look into.

Kindest regards
Phil.

> --~--~---------~--~----~------------~-------~--~----~
> You received this message because you are subscribed to the Google
> Groups "Joomla! General Development" group.
> To post to this group, send email to joomla-de...@googlegroups.com
> To unsubscribe from this group, send email to
> joomla-dev-gene...@googlegroups.com
> For more options, visit this group at
> http://groups.google.com/group/joomla-dev-general?hl=en-GB
>
> -~----------~----~----~----~------~----~------~--~---
>

[Oli Griffiths]

You're welcome!

Glad to help.

Oli

[Ryan W. Ozimek]

Oli,

Alright, this is great news! You've got your third party validation that
this is likely a bug. Can you drop it, with a patch, into the tracker, and
the Joomla Bug Squad should be able to onboard it from there.

Nice work!

-Ryan

> -----Original Message-----
> From: joomla-de...@googlegroups.com
> [mailto:joomla-de...@googlegroups.com] On Behalf Of Oli
> Griffiths
> Sent: Thursday, May 21, 2009 10:57 AM
> To: joomla-de...@googlegroups.com
> Subject: Re: Bug in JRouterSite::_parseRawRoute, incorrectly
> checking the URI for Itemid
>
>

[Ian MacLennan]

Yes, please do, and we'll try and get this through process for 1.5.12.

Thanks,
Ian

[Oli Griffiths]

Hi Guys,

 I uncovered slightly more to this problem.

Whilst the first fix solves the issue of posting with not itemid / option, I noticed that the router still had incorrect values in its internal _vars array that holds the request vars (I think).

Line 139 of /includes/router.php has

$this->setVars($uri->getQuery(true))

This problem with this again is its using the request uri to get the variables, and if posting to index.php, the request uri is blank.

However, if you merge the request uri vars with the post vars it appears to populate the routers _vars array correctly:

$this->setVars(array_merge($uri->getQuery(true), JRequest::get('post')));

Now the router contains all the request vars rather than just ones from the uri.

Hope this helps

Oli