User tests: Successful: Unsuccessful:
Pull Request resolves #47318
This PR fixes an issue where passing an array via query parameters (e.g. ?id[]=1) causes a 500 error due to strict type checking in PHP 8.x.
The error occurs in PreprocessRules::preprocess() where strpos() expects a string but receives an array when query parameters are sent in array form.
The fix adds defensive validation in the router:
PreprocessRules now verifies that the processed parameter is a scalar before performing string operations.strpos() from receiving an invalid type.This ensures the router safely handles malformed or manually crafted query parameters and prevents the TypeError from occurring.
?id[]=1index.php?option=com_content&view=article&id[]=1Joomla throws a 500 error:
TypeError:
strpos(): Argument #1 ($haystack) must be of type string, array given
Joomla safely handles the request without throwing an exception, and the page loads normally.
Please select:
Documentation link for guide.joomla.org:
No documentation changes for guide.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | Libraries |
| Labels |
Added:
PR-5.4-dev
|
||
ai:dr
Thanks for observation @richard67
An earlier version of this PR included input normalization in Joomla\CMS\Input\Input::get(). However, that change was removed because Joomla\CMS\Input\Input is deprecated and the PHPStan check failed.
The current fix only adds defensive handling in PreprocessRules::preprocess() to ensure strpos() does not receive an array when malformed parameters like ?id[]=1 are passed. I will update the PR description accordingly.
@narang24 I can't see that change here: https://github.com/joomla/joomla-cms/pull/47319/changes