pkp-lib
pkp-lib copied to clipboard
Date input parameters in article search must be checked for validity
Describe the bug Non-valid characters in the date parameters of an article search in OJS lead to a white page (HTTP 500 status) and a PHP fatal error.
PHP Fatal error: Uncaught TypeError: mktime(): Argument #6 ($year) must be of type ?int, string given in /usr/local/hope/www/ojs/lib/pkp/classes/core/PKPRequest.php:698
To Reproduce
- Go to the search page of an OJS installation
- Choose a date in the Filter section for the Published After or Published Before section carry out the search
- in the URL in the browser, change a value of the date parameters, e.g. dateFromYear, from an integer to a non-integer value
E.g. https://{baseurl}/search/index?query=&dateFromYear=2021&dateFromMonth=2&dateFromDay=1&dateToYear=&dateToMonth=&dateToDay=&authors=
to https://{baseurl}/search/index?query=&dateFromYear=2021xx&dateFromMonth=2&dateFromDay=1&dateToYear=&dateToMonth=&dateToDay=&authors=
and carry the search out eg.
A white page results the PHP Fatal error: Uncaught TypeError: mktime(): Argument error is produced.
What application are you using? OJS 3.4.0-5
** Possible solution ** Validate the input parameters and provide an error message on the page
Additional information We observe these errors more than 100 times per week. Whether these are caused by faulty bot URLs or by hacking or other reasons, is unclear.