Description
When a ParamType::BOOL parameter receives a native PHP false value (e.g., from $_POST set directly in tests), the applyBasicFilterOnly method calls strip_tags($toBeFiltered) before checking the type. Since strip_tags(false) casts false to an empty string "", the subsequent filterBoolean("") call fails to match any known boolean value and returns self::INVALID.
Steps to Reproduce
- Define an API parameter with
ParamType::BOOL
- Pass native PHP
false as the parameter value (e.g., $_POST["param"] = false)
- The parameter is reported as invalid
Root Cause
In APIFilter.php line ~347:
private static function applyBasicFilterOnly($def, $toBeFiltered) {
if (gettype($toBeFiltered) == 'array') {
return $toBeFiltered;
}
$toBeFiltered = strip_tags($toBeFiltered); // <-- false becomes ""
// ...
if ($paramType == ParamType::BOOL) {
$returnVal = self::filterBoolean($toBeFiltered); // filterBoolean("") fails
}
}
The filterBoolean method correctly handles native booleans:
private static function filterBoolean($boolean) {
if (gettype($boolean) == 'boolean') {
return $boolean; // <-- never reached because strip_tags already converted it
}
// ...
}
Expected Behavior
Native PHP false should be accepted as a valid boolean parameter value.
Suggested Fix
Check for boolean type before calling strip_tags:
private static function applyBasicFilterOnly($def, $toBeFiltered) {
if (gettype($toBeFiltered) == 'array') {
return $toBeFiltered;
}
if (gettype($toBeFiltered) == 'boolean') {
return $toBeFiltered;
}
$toBeFiltered = strip_tags($toBeFiltered);
// ...
}
Environment
- webfiori/http version: installed via webfiori/framework v3.0.0-RC.4
- PHP 8.4
Description
When a
ParamType::BOOLparameter receives a native PHPfalsevalue (e.g., from$_POSTset directly in tests), theapplyBasicFilterOnlymethod callsstrip_tags($toBeFiltered)before checking the type. Sincestrip_tags(false)castsfalseto an empty string"", the subsequentfilterBoolean("")call fails to match any known boolean value and returnsself::INVALID.Steps to Reproduce
ParamType::BOOLfalseas the parameter value (e.g.,$_POST["param"] = false)Root Cause
In
APIFilter.phpline ~347:The
filterBooleanmethod correctly handles native booleans:Expected Behavior
Native PHP
falseshould be accepted as a valid boolean parameter value.Suggested Fix
Check for boolean type before calling
strip_tags:Environment