Home » Authentication » Auth » Bug #3099

[2005-01-04 21:20 UTC] herojoker at nexgo dot de

Description:
------------
In Auth.php on line 576 in getAuthData($name = null) is a check whether the passed parameter is not null. If it is not, the session value with the passed parameter is returned, but there is no assurance for the existence of the "returned" value.

Reproduce code:
---------------
The error causing method:

function getAuthData($name = null) {
if (!isset($this->session['data'])) {
return null;
}
if (!is_null($name)) {
return $this->session['data'][$name];
}

return $this->session['data'];
}

The bad check is

if (!is_null($name)) {...}

You should add or change something like this:

if (isset($this->session['data'][$name])) {
return $this->session['data'][$name];
}

Expected result:
----------------
There should be no PHP error when asking for non existent session values.

Actual result:
--------------
If you ask for a non existent value there will be even an error thrown "Undefined index:...".

[2005-01-04 21:22 UTC] herojoker at nexgo dot de

I hope you will fix it soon,
Thx, Hero Wanders

[2005-01-04 22:31 UTC] herojoker at nexgo dot de

You should better use the following code.
It meets the description of the method and returns what the user expects.

function getAuthData($name = null) {
if (!isset($this->session['data'])) {
return null;
}

if (is_null($name)) {
return $this->session['data'];
}

if (isset($this->session['data'][$name])) {
return $this->session['data'][$name];
} else {
return null;
}
}