From e3714c86a7d5b9b7f1d413b6c4aba20f3ef8edb5 Mon Sep 17 00:00:00 2001 From: Andre Klapper Date: Mon, 5 Feb 2024 22:41:13 +0100 Subject: [PATCH] Validate PhabricatorSearchTextField value not to be an array Summary: PhabricatorSearchTextField.php's parent class PhabricatorSearchField.php defines an (empty) `protected function validateControlValue($value)`. Override this function in PhabricatorSearchTextField.php by disallowing arrays (as the only data type which cannot be casted into a text value). Closes T15714 Test Plan: Apply D25518; then manually edit the code in `ManiphestTaskSearchEngine.php` by defining an array and passing that array to the Page Size text field via `id(new PhabricatorSearchTextField())->setDefaultValue($empty_array)`, then go to `/maniphest/query/advanced/` and see the error message. Reviewers: O1 Blessed Committers, 20after4 Reviewed By: O1 Blessed Committers, 20after4 Subscribers: 20after4, tobiaswiese, valerio.bozzolan, Matthew, Cigaryno Maniphest Tasks: T15714 Differential Revision: https://we.phorge.it/D25519 --- .../search/field/PhabricatorSearchTextField.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/applications/search/field/PhabricatorSearchTextField.php b/src/applications/search/field/PhabricatorSearchTextField.php index 915f22a6e9..21d256e882 100644 --- a/src/applications/search/field/PhabricatorSearchTextField.php +++ b/src/applications/search/field/PhabricatorSearchTextField.php @@ -11,6 +11,15 @@ final class PhabricatorSearchTextField return $request->getStr($key); } + protected function validateControlValue($value) { + if (!is_array($value)) { + return; + } + $this->addError( + pht('Invalid'), + pht('Text value for "%s" can not be parsed.', $this->getLabel())); + } + protected function newControl() { return new AphrontFormTextControl(); }