[#26505] - [4.0][plugin][httpheaders] - array to string conversion
- Closed
- 1 Feb 2020
- Medium
- Build: 4.0-dev
- # 26505
- Diff
- alikon:patch-109
- Pending Hound Hound is busy sniffing around... Details
User tests: Successful: Unsuccessful:
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Front End Plugins |
Maybe we can use existing MD5 hashes?
| Labels |
Added:
?
|
||
used implode and the md5 value....
No, not like that. I was thinking we could reuse MD5 hashes but says here it's not recommended https://www.w3.org/TR/SRI/#cryptographic-hash-functions.
back to implode
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
This doesn't work. Each script/style tag needs to have its own hash. And the hash must be based on the content exactly as it appears on on the page. The content from head data does not contain formatting added by styles renderer.
| Status | Ready to Commit | ⇒ | Pending |
I have not tested this item.
Setting to not tested until clarifications and reviews finished.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
I have not tested this item.
OK, I did also set to "Not tested" now.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
Please provide real testing instructions - not just see that the warning has gone
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
I have tested this item
As expected: warning without the patch, no warning after applying the patch.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.
This hides the notice but the code is still broken.
Since #25357 rendered scripts/styles have formatting added to them. But the hash is generated from scripts/styles without formatting. So the hashes don't match scripts/styles that appear on the page.
Assuming SRI works on pages with MIME type other than text/html, this was actually broken since the beginning because we wrap code in CDATA on such pages:
Ah ok I get the point now.
| Status | Ready to Commit | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-02-01 10:52:21 |
| Closed_By | ⇒ | alikon | |
| Labels |
Added:
?
|
||
I have tested this item✅ successfully on f2440d6
Confirm before Patch:
Warning: hash() expects parameter 2 to be string, array given in \plugins\system\httpheaders\httpheaders.php on line 161
Warning: hash() expects parameter 2 to be string, array given in \plugins\system\httpheaders\httpheaders.php on line 172
After Patch: Warnings has gone.
OT: Which Mode should be use?
Custom / Detect or Automatic?
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26505.