Problem/Motivation

In the flood system

  public function register($name, $window = 3600, $identifier = NULL) {
    if (!isset($identifier)) {
      $identifier = $this->requestStack->getCurrentRequest()->getClientIp();
    }
    // We can't use REQUEST_TIME here, because that would not guarantee
    // uniqueness.
    $time = microtime(TRUE);
    $this->events[$name][$identifier][] = ['expire' => $time + $window, 'time' => $time];
  }

But the implementation for Request::getClientIp() does this

    public function getClientIp(): ?string
    {
        return $this->getClientIps()[0];
    }

Which means $identifier can still be null which is a problem. Especially in PHP 8.5 where this triggers a deprecation ... and this is why because it is helping us find a bug.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3554723

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

alexpott created an issue. See original summary.

alexpott’s picture

alexpott’s picture

andypost’s picture

Status: Active » Needs work

IP address could be NULL (even SF fixed it) so not sure now flood may work in CLI where request has no IP or runtime where server is misconfigured

andypost’s picture

Issue tags: +PHP 8.5
alexpott’s picture

@andypost but flood in cli makes no sense :)

alexpott’s picture

Status: Needs work » Needs review

For me we should fix the test so that it passes on PHP 8.5 and leave the code as is. Once the deprecation becomes an exception then any calling code that uses flood and doesn't have an IP address we'll get an exception which in my mind is correct and good behaviour.

alexpott’s picture

andypost’s picture

Status: Needs review » Reviewed & tested by the community

Thank you! ++ to fix the test and wait PHP 9.0

  • catch committed 4da595fb on 11.x
    Issue #3554723 by alexpott, andypost: Flood system needs to handle NULL...
catch’s picture

Version: 11.x-dev » 11.3.x-dev
Status: Reviewed & tested by the community » Fixed

but flood in cli makes no sense

I think I've used flood as a 'rate limiter' in custom code before, but in those cases the identifier shouldn't be the IP address or could be explicitly set to 127.0.0.1 or whatever.

Committed/pushed to 11.x and cherry-picked to 11.3.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • catch committed 0baddb31 on 11.3.x
    Issue #3554723 by alexpott, andypost: Flood system needs to handle NULL...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.