Problem/Motivation
In the flood system
public function register($name, $window = 3600, $identifier = NULL) {
if (!isset($identifier)) {
$identifier = $this->requestStack->getCurrentRequest()->getClientIp();
}
// We can't use REQUEST_TIME here, because that would not guarantee
// uniqueness.
$time = microtime(TRUE);
$this->events[$name][$identifier][] = ['expire' => $time + $window, 'time' => $time];
}
But the implementation for Request::getClientIp() does this
public function getClientIp(): ?string
{
return $this->getClientIps()[0];
}
Which means $identifier can still be null which is a problem. Especially in PHP 8.5 where this triggers a deprecation ... and this is why because it is helping us find a bug.
Steps to reproduce
Proposed resolution
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
Comments
Comment #2
alexpottComment #3
alexpottComment #5
andypostIP address could be NULL (even SF fixed it) so not sure now flood may work in CLI where request has no IP or runtime where server is misconfigured
Comment #6
andypostComment #7
alexpott@andypost but flood in cli makes no sense :)
Comment #8
alexpottFor me we should fix the test so that it passes on PHP 8.5 and leave the code as is. Once the deprecation becomes an exception then any calling code that uses flood and doesn't have an IP address we'll get an exception which in my mind is correct and good behaviour.
Comment #9
alexpottComment #10
andypostThank you! ++ to fix the test and wait PHP 9.0
Comment #12
catchI think I've used flood as a 'rate limiter' in custom code before, but in those cases the identifier shouldn't be the IP address or could be explicitly set to 127.0.0.1 or whatever.
Committed/pushed to 11.x and cherry-picked to 11.3.x, thanks!