Drupal uses fix_gpc_magic() to compensate for web-server environments that have "magic quotes" enabled, such that $_POST data are always extracted consistently. However, the parse_str() method that is used by ServicesParserURLEncoded->parse() does not apply the same kind of compensation, which leads to inconsistent data parsing when the same resource is deployed in environments that are configured differently. Currently, values that contain single or double quotes will get mangled on some machines before the data arguments reach a resource callback method.

The ServicesParserURLEncoded->parse() method must always extract the data values the same way, irrespective of the get_magic_quotes_gpc() configuration.

CommentFileSizeAuthor
#3 services-servicesparserurlencoded_mangles_data-2123447-3.patch847 bytesTiaan
#1 servicesparserurlencoded_mangles_data-2123447-1.patch847 bytesTiaan
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Tiaan’s picture

Tiaan CreditAttribution: Tiaan commented
Status: Active » Needs review
FileSize
servicesparserurlencoded_mangles_data-2123447-1.patch847 bytes

The attached patch uses drupal_get_query_array(), instead of parse_str(), which works irrespective of the specific "magic quotes" settings of a website.

Status: Needs review » Needs work

The last submitted patch, servicesparserurlencoded_mangles_data-2123447-1.patch, failed testing.

Tiaan’s picture

Tiaan CreditAttribution: Tiaan commented
Version: 7.x-3.5 » 7.x-3.x-dev
Issue summary: View changes
Status: Needs work » Needs review
FileSize
services-servicesparserurlencoded_mangles_data-2123447-3.patch847 bytes

Attached is the same patch as before, except for being renamed to have the project name as prefix, and targeting the 3.x-dev branch.

marcingy’s picture

marcingy CreditAttribution: marcingy commented
Status: Needs review » Reviewed & tested by the community
ygerasimov’s picture

ygerasimov CreditAttribution: ygerasimov commented
Status: Reviewed & tested by the community » Fixed

Committed. Thanks.

kylebrowning’s picture

kylebrowning CreditAttribution: kylebrowning commented

Hrmm, this is breaking all of my tests locally.

kylebrowning’s picture

kylebrowning CreditAttribution: kylebrowning commented
Status: Fixed » Needs work

Ive rolled this back, because its breaking my tests and I cannot seem to get it to pass on my local.

If you turn off magic quotes, the tests break, so this fix is not finished.

The last submitted patch, 3: services-servicesparserurlencoded_mangles_data-2123447-3.patch, failed testing.

ygerasimov’s picture

ygerasimov CreditAttribution: ygerasimov commented
Status: Needs work » Closed (won't fix)

Sorry for committing. If this breaks tests lets close this issue with won't fix status. It is pretty easy to override this part for custom implementation.