This also happens with JRequest::getFloat

Current regex for float is:

$pattern = '/[-+]?[0-9]+(\.[0-9]+)?([eE][-+]?[0-9]+)?/';

which as you may be able to see, doesn't allow the value to start with a decimal. It would have to be changed to:

$pattern = '/[-+.]?[0-9]+(\.[0-9]+)?([eE][-+]?[0-9]+)?/';
                ^

However looking at the PHP Documentation, I think this is expected.

Perhaps the INT/INTEGER filter should be updated to allow a starting decimal place.

@mbabker ?

I would think the actual change would be as follows:

$pattern = '/[-+]?[0-9]*(\.[0-9]+)?([eE][-+]?[0-9]+)?/';
                       ^

My opinion. If PHP can't natively convert .25 to 0.25 I would be careful with adding support for that to our filtering library. As it's supposed to be a filter, I wouldn't add too much magic to make it work as more.

That said, if it does handle it fine, feel free to submit a PR with appropriate unit test coverage (just adding another case to the existing array of cases). As security sensitive code, I push a little more for changes in JFilterInput to be backed with unit tests than I do for other classes.

PHP converts .25 to 0.25 just fine, and this is supported by the documentation cited by C-Lodder. Check out the DNUM pattern, quoted from that page:

LNUM          [0-9]+
DNUM          ([0-9]*[\.]{LNUM}) | ({LNUM}[\.][0-9]*)
EXPONENT_DNUM [+-]?(({LNUM} | {DNUM}) [eE][+-]? {LNUM})

If you really need a code example, see:

echo floatval('.25') === 0.25 ? 'Good' : 'Bad';
echo "\n<br/>\n";
echo floatval('.25') === .25 ? 'Good' : 'Bad';

This produces the following string on all versions I tested:
Good
Good

Then someone feel free to submit the pull request. I just wanted to make sure we aren't adding more magic behavior is all.

@JTBlum have you had a chance to do a pull request?

I’m afraid I’m not experienced enough with Github or with the Joomla core itself to make the change and be at all confident I haven’t broken something else. I was hoping someone else would address the issue.

@Franz: Thanks for confirming this.

@JTBlum I have submitted the PR with the code you propose in #14156 (comment) as after testing the ReGex it seems right.

Set to "closed" on behalf of @franz-wohlkoenig by The JTracker Application at issues.joomla.org/joomla-cms/14156

closed as having PR #15736