pkp-lib icon indicating copy to clipboard operation
pkp-lib copied to clipboard

Date input parameters in article search must be checked for validity

Open mpbraendle opened this issue 5 months ago • 0 comments

Describe the bug Non-valid characters in the date parameters of an article search in OJS lead to a white page (HTTP 500 status) and a PHP fatal error.

PHP Fatal error: Uncaught TypeError: mktime(): Argument #6 ($year) must be of type ?int, string given in /usr/local/hope/www/ojs/lib/pkp/classes/core/PKPRequest.php:698

To Reproduce

  1. Go to the search page of an OJS installation
  2. Choose a date in the Filter section for the Published After or Published Before section carry out the search
  3. in the URL in the browser, change a value of the date parameters, e.g. dateFromYear, from an integer to a non-integer value

E.g. https://{baseurl}/search/index?query=&dateFromYear=2021&dateFromMonth=2&dateFromDay=1&dateToYear=&dateToMonth=&dateToDay=&authors=

to https://{baseurl}/search/index?query=&dateFromYear=2021xx&dateFromMonth=2&dateFromDay=1&dateToYear=&dateToMonth=&dateToDay=&authors=

and carry the search out eg.

A white page results the PHP Fatal error: Uncaught TypeError: mktime(): Argument error is produced.

What application are you using? OJS 3.4.0-5

** Possible solution ** Validate the input parameters and provide an error message on the page

Additional information We observe these errors more than 100 times per week. Whether these are caused by faulty bot URLs or by hacking or other reasons, is unclear.

mpbraendle avatar Sep 06 '24 12:09 mpbraendle