I get an exception when I make a curl request to /user/password with invalid parameters.
Ex:
curl -X POST --form name%5B0%5D="" --form form_id=user_pass -- http://test.local/user/password?name%5B0%5D

curl -X POST --form form_id=user_pass http://test.local/user/password?name%5B0%5D=""

Drupal\Core\Database\InvalidQueryException: Query condition 'users_field_data.mail IN ()' cannot be empty. in Drupal\Core\Database\Query\Condition->condition() (line 103 of web/core/lib/Drupal/Core/Database/Query/Condition.php).

I am not sure if this a user.module issue or not.

CommentFileSizeAuthor
#13 interdiff-5-13.txt446 bytesnaresh_bavaskar
#13 3086475-13.patch1.99 KBnaresh_bavaskar
#10 interdiff_3086475-3-5.txt950 bytesnaresh_bavaskar
#10 3086475-5.patch2 KBnaresh_bavaskar
#5 3086475-4.patch2 KBnaresh_bavaskar
#4 query-condition-invalid-3086475-3.patch989 bytesleontin
#2 query-condition-invalid-3086475-1.patch757 bytesleontin

Comments

leontin created an issue. See original summary.

leontin’s picture

leontin commented
StatusFileSize
new query-condition-invalid-3086475-1.patch757 bytes

This is a temporary patch.
I still get warnings:
Warning: mb_strlen() expects parameter 1 to be string, array given in Drupal\Core\Form\FormValidator->performRequiredValidation() (line 333 of core/lib/Drupal/Core/Form/FormValidator.php).

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

leontin’s picture

leontin commented
StatusFileSize
new query-condition-invalid-3086475-3.patch989 bytes

Patch for 8.8.x

naresh_bavaskar’s picture

naresh_bavaskar
Location Pune, Maharashtra
commented
Status: Active » Needs review
StatusFileSize
new 3086475-4.patch2 KB

@leontin I have fixed the Warning: "mb_strlen() expects parameter 1 to be string"
Please review

hardik_patel_12’s picture

hardik_patel_12 commented
Assigned: Unassigned » hardik_patel_12
hardik_patel_12’s picture

hardik_patel_12 commented

just 1 thing @naresh_bavaskar we are checking parameter 1 to be string for mb_strlen() so instead of checking with (!is_array) please use (is_string) function.

hardik_patel_12’s picture

hardik_patel_12 commented
Assigned: hardik_patel_12 » Unassigned
naresh_bavaskar’s picture

naresh_bavaskar
Location Pune, Maharashtra
commented
Assigned: Unassigned » naresh_bavaskar
Status: Needs review » Needs work

@hardik_patel
ok, let me check and update the patch.

naresh_bavaskar’s picture

naresh_bavaskar
Location Pune, Maharashtra
commented
Assigned: naresh_bavaskar » Unassigned
Status: Needs work » Needs review
StatusFileSize
new 3086475-5.patch2 KB
new interdiff_3086475-3-5.txt950 bytes

Updated the patch with changes per above comment.

Status: Needs review » Needs work

The last submitted patch, 10: 3086475-5.patch, failed testing. View results

hardik_patel_12’s picture

hardik_patel_12 commented

I think $elements['#value'] is not alway string , @naresh_bavaskar as you have written condition in #5 is working properly for $elements['#value'].
Kindly re-apply that.

naresh_bavaskar’s picture

naresh_bavaskar
Location Pune, Maharashtra
commented
Status: Needs work » Needs review
StatusFileSize
new 3086475-13.patch1.99 KB
new interdiff-5-13.txt446 bytes

fixed the above testing fails errors.
please review

naresh_bavaskar’s picture

naresh_bavaskar
Location Pune, Maharashtra
commented
hardik_patel_12’s picture

hardik_patel_12 commented
Status: Needs review » Reviewed & tested by the community

Patch is looking good to me and it is working properly.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Reviewed & tested by the community » Needs work 
+++ b/core/lib/Drupal/Core/Form/FormValidator.php
@@ -330,7 +330,7 @@ protected function doValidateForm(&$elements, FormStateInterface &$form_state, $
-    if (isset($elements['#maxlength']) && mb_strlen($elements['#value']) > $elements['#maxlength']) {
+    if (isset($elements['#maxlength']) && !is_array($elements['#value']) && mb_strlen($elements['#value']) > $elements['#maxlength']) {

This change would need test coverage if it is necessary.

I'm not sure that we expect incomplete forms to be posted via curl to Drupal. This is not API. Why should we fix this?

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

leontin’s picture

leontin commented
Issue summary: View changes

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Version: 9.4.x-dev » 10.0.x-dev
Status: Needs work » Postponed (maintainer needs more info)
Issue tags: +Bug Smash Initiative

In #16 alexpott asked

I'm not sure that we expect incomplete forms to be posted via curl to Drupal. This is not API. Why should we fix this?

There has been no response to that in 2 years 4 months.

Since we need more information to move forward with this issue, I am changing the status at Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Also, I tests on Drupal 10 and using curl -X POST --form form_id=user_pass http://test.local/user/password?name%5B0%5D="" the error is now

Symfony\Component\HttpKernel\Exception\BadRequestHttpException: Input value "name" contains a non-scalar value. in Symfony\Component\HttpKernel\HttpKernel->handle() (line 77 of /var/www/html/vendor/symfony/http-kernel/HttpKernel.php)

. The change is most likely due to #1521996: Password reset form reveals whether an email or username is in use.

cilefen’s picture

cilefen commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)