Bug #9438: Be less restrictive about the input to Horde_Secret::read/write()
authorGunnar Wrobel <p@rdus.de>
Thu, 9 Dec 2010 17:01:48 +0000 (18:01 +0100)
committerGunnar Wrobel <p@rdus.de>
Thu, 9 Dec 2010 17:01:48 +0000 (18:01 +0100)
commita6267c6747973b74c6b58c2f2a75ad63c03389b6
tree9e15fa228eb8051d26c6fa598d95f2d3c6bd2e6a
parentb10d3bd17fc601167864b64d57baad01dcc06b96
Bug #9438: Be less restrictive about the input to Horde_Secret::read/write()

I originally assumed that it makes sense to pull the is_string() check
from Crypt_Blowfish into Horde_Secret (as Crypt_Blowfish would die on
anything not a string). I overlooked however that we had a strlen()
check before delegating to Crypt_Blowfish. As strlen(null) or
strlen(false) is int(0) both can be passed into
Horde_Secret::read/write() without causing problems.

Type casting the input into a string instead of checking the type
should fix the problems.
framework/Secret/lib/Horde/Secret.php
framework/Secret/test/Horde/Secret/Unit/SecretTest.php