I just ran the Views security update and got a WSOD when I ran update.php.

I'm looking at the code now but thought I would lodge the bug report first to prevent others from breaking their sites.

Cheers,
Andrew

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

awasson created an issue. See original summary.

awasson’s picture

This is a PHP version issue. I restored the site with a copy of Views 7.x-3.20 and then noted the version of PHP they are running is PHP 5.x.

The problem code is:

$this->handler->table_aliases = [];

The older version of PHP won't parse that.

Andrew

darkodev’s picture

+1

Forced to run older version of PHP on RHEL

andrewfn’s picture

I'm getting exactly the same problem on my clients who have older servers.

darkodev’s picture

Looks like line 1010 also

$join->extra = [];

ron_s’s picture

Any [] needs to be set to array() to work with PHP 5.x.

Edit: Just to be clear, this impacts earlier versions of PHP 5. I believe PHP 5.3.x requires array()

dromansab’s picture

Hello,

You have to change [] for array().
I've created a patch.

darkodev’s picture

Patch in #7 works here.

joseph.olstad’s picture

Status: Active » Needs review

trigger tests

awasson’s picture

Patch in #7 works here too.

joseph.olstad’s picture

Title: Parse error: syntax error, unexpected '[' in views/includes/handlers.inc on line 1003 » php 5.3.x fix for views 3.21 - Parse error: syntax error, unexpected '[' in views/includes/handlers.inc on line 1003
TheWrench’s picture

Patch in #7 works great for my sites as well

joseph.olstad’s picture

Status: Needs review » Reviewed & tested by the community

patch 7 looks good as reported

php lint passes for php 5.3.x

https://www.drupal.org/pift-ci-job/1227497

14:51:07 ----------------   Starting phplint   ----------------
14:51:07 Directory created at /var/lib/drupalci/workspace/jenkins-drupal_d7-126508/ancillary/phplint
14:51:07 SyntaxCheck checking for php syntax errors.
14:51:07 /var/lib/drupalci/workspace/jenkins-drupal_d7-126508/ancillary/phplint/lintable_files.txt
14:51:07 cd /var/www/html && xargs -P 36 -a /var/lib/drupalci/workdir/phplint/lintable_files.txt -I {} php -l '{}'
14:51:07 No syntax errors detected in /var/www/html/sites/all/modules/views/includes/handlers.inc
14:51:07 ---------------- Finished phplint in 0.350 seconds ---------------- 
joseph.olstad’s picture

Status: Reviewed & tested by the community » Needs work

patch 7 works for the code, but the test code still contains [] syntax instead of array()
this explains why the php lint passes on the module but the tests fail

javier1968’s picture

Same issue for us, how is one supposed to apply the patch? which file would we need to modify?

Any help will be greatly appreciated?

awasson’s picture

@javier1968, I suspect there will be another Views update that will include the patch forthcoming.

If you are in a rush, you can apply the patch to a local copy of views 3.21 using your bash terminal by following the instructions on this page: https://www.oliverdavies.uk/articles/quickly-apply-patches-using-git-and...

I tend to use the curl method as not all systems have wget.

Once you've patch the module it should be good to go and you can manually update it with git or ftp (whatever method you are using for file transfer).

I'll be waiting for a fully baked update from the views folks.

Andrew

deker0’s picture

I want to wait on a fully baked update as well. Do we know if they would release that today? Or this may be a few days away?

javier1968’s picture

@awasson Thanks Andrew I shall do the same.

Best

hawkdavis’s picture

How bad is the security issue for the module update that was released? Does the patch in #7 still mitigate this security issue?

DamienMcKenna’s picture

Version: 7.x-3.21 » 7.x-3.x-dev

The patch in #7 will resolve the PHP syntax problem we introduced by through the fact we use newer versions of PHP locally. It in no way affects the security problems resolved in 7.x-3.21, so you're free to use the patch with 3.21 and not loose any of the security fixes.

DamienMcKenna’s picture

Also, sorry for not catching that.

TheWrench’s picture

@DamienMckenna thank you for all that you do!! :-)

hawkdavis’s picture

Yes, thank you! @DamienMckenna

darkodev’s picture

Another thanks to @DamienMckenna!

Wondering how we mitigate this going forward in the contrib space. I'm also guilty of accidentally using short array syntax locally without thought of very old versions. We wish 5.3 wasn't still deployed, but we need to keep supporting it since it's on the list (for now):
https://www.drupal.org/docs/7/system-requirements/php-requirements#php_r...

Even after it's removed, using short array syntax will break a ton of sites in higher ed, for example, that often lag tremendously in updating their infrastructure.

joelpittet’s picture

Status: Needs work » Needs review
FileSize
2.25 KB

Reroll with the tests changed to traditional syntax as well.

awasson’s picture

Status: Needs review » Reviewed & tested by the community
DamienMcKenna’s picture

I've kicked off a PHP 5.3 testbot on patch #25..

awasson’s picture

Thanks @DamienMcKenna.

Also thanks for keeping on top of everything else you do maintaining/co-maintaining.

javier1968’s picture

Any ETA for the release of the new module update?

JohnFF’s picture

Please merge this patch ASAP - badly needed.

Excellent job dromansab, joelpittet

Massimo25’s picture

I prefer to wait for the next version because I'm using php 5.3 on D7 and apparently the problem is giving it to everyone

ron_s’s picture

@Massimo25, you should be able to use the patch with confidence until a new version is available. Certainly not having the patch creates a problem for those running PHP 5.3.x, but it's a minor issue in the entire scope of possible issues.

DamienMcKenna’s picture

DamienMcKenna’s picture

Title: php 5.3.x fix for views 3.21 - Parse error: syntax error, unexpected '[' in views/includes/handlers.inc on line 1003 » PHP 5.3.x fix for syntax changes Views 3.21

  • DamienMcKenna committed 6a547c3 on 7.x-3.x
    Issue #3039953 by joelpittet, dromansab, awasson, joseph.olstad,...
DamienMcKenna’s picture

Status: Reviewed & tested by the community » Fixed
Parent issue: » #2960871: Plan for Views 7.x-3.23 release

Committed. Thank you to everyone for working on this, I really appreciate it and, again, I'm sorry for letting that syntax change slip past us.

I'd like to encourage people with sites still using PHP 5.3 to: a) upgrade to a newer version of PHP, b) help test the current dev snapshot so we can get a 7.x-3.22 out ASAP with this and a wealth of other fixes.

joelpittet’s picture

I’ve been using the dev snapshot on at least of the sites we manage still on PHP 5.3. It has a nice notice fix for exposed filters:)

Asterovim’s picture

Patch #25 works thanks you !

nno’s picture

I can confirm that current dev fixes the issue on PHP 5.3.3

Thank you!

donaldp’s picture

I can also confirm that patch #25 is working OK on a couple of different servers and sites. Thanks.

ju1i3’s picture

Using shared hosting, one is at the mercy of the host for the PHP version. Through this problem I've discovered I could specify 5.6 at the host's control panel (their default was 5.3).

Views now installs fine.

DamienMcKenna’s picture

PHP 5.3 hasn't been officially supported by the PHP community in.. four and a half years, asking your hosting provider to upgrade their out-of-date software isn't irrelevant, neither is suggesting you consider a different hosting provider that puts a bit more effort into maintaining their infrastructure.

joseph.olstad’s picture

Red Hat is still supporting php 5.3.x afaik.
however, ya , I always encourage my clients to upgrade to php 7.x but this is not always easy to do as often they have servers hosting multiple applications.

Massimo25’s picture

Guys, in the meantime I run the update in case it causes problems retrocedo to the previous version but I suppose everything should be fine

achillespogi’s picture

Thanks for this, This solved my issue.
This should be included in the next release

tarzadon’s picture

I had the same error as described in: https://www.drupal.org/project/views/issues/3040789 when updating views with drush.

For what it's worth, I am running PHP 5.6.25 on RHEL 6.10 via Software Collections.

I applied patch #25 and no longer see the error.

joseph.olstad’s picture

Tarzadon,
Your vhost is misconfigured if you say you needed this patch for php 5.6.x

This is a php <= 5.3.x bug. Not 5.6

bsevere’s picture

Happy to report that the dev version works for us! Many thanks!

Eduardo Alvarez’s picture

Patch #25 resolved the issue for us.
We are also blocked with version 5.3.3 due RHEL 6

Thanks for the patch

David Radcliffe’s picture

Patch #25 worked for me. We have been hit with this issue several times because we have support contracts with sites that are running PHP 5.3, so I hope that a new version will be released soon.

TR’s picture

Can we get a new release with this fix, so that it doesn't keep breaking contrib testing with PHP 5.3?

gr8’s picture

could anyone tell us when the new release that will work for 5.3 will be please?

awasson’s picture

@TR and @gr8, I believe the 7.x-3.x-dev will work.

For my purposes, I downloaded Views 3.21 and applied the patch from #25 to use for the sites I maintain on older versions of PHP.

TR’s picture

@awasson: You missed my point. Contributed module which have a dependency on Views cannot currently be tested against PHP 5.3 because the testbot uses the 3.21 release for testing, not the -dev, and not a patched version.

Because Views is so widely used, and because so many contributed modules depend on Views, PHP 5.3 testing is currently broken for many Drupal 7 modules. That is why a new release is needed as soon as possible.

awasson’s picture

@TR, you're preaching to the choir.

I haven't missed your point. I just have zero influence on what the Views Team do. I do however realize that websites must continue running in the meantime so I'm pointing you (and anyone else) at the solution that will keep your site secure and prevent a WSOD.

Here's the issue you're looking for: https://www.drupal.org/project/views/issues/2960871

TR’s picture

@awasson: Oh, I guess *I* missed *your* point :-)

  • DamienMcKenna committed c62be3b on 7.x-3.x
    Issue #3039953 by joelpittet, dromansab, awasson, joseph.olstad,...
DamienMcKenna’s picture

I decided to release this one single fix as 7.x-3.22: https://www.drupal.org/project/views/releases/7.x-3.22

Sorry for taking so long.

awasson’s picture

Awesome! Thanks @DamienMcKenna

Pepe Roni’s picture

Sorry, the problem still persists for aggregated views. Had to return to 3.20 on a production site. :(
As the site is running with docker I will upgrade to php7 soon.

DamienMcKenna’s picture

@Pepe Roni: Please a) test the current dev snapshot, b) check other issues, this one was just about the syntax problems.

Pepe Roni’s picture

Warning: Illegal offset type in views_many_to_one_helper->ensure_my_table() (Zeile 1023 von /var/www/html/drupal/sites/all/modules/contrib/views/includes/handlers.inc).
and
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')AND (field_myfieldname' at line 12
are the errors described in this issue.
At least these errors do not occur in 3.20.

Just checked: the current dev-snapshot has solved this problem :)

DamienMcKenna’s picture

@Pepe: Thank you for the update.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.