-
Notifications
You must be signed in to change notification settings - Fork 223
Description
Seen with spell 50, which has a numeric name_loc8 and description_loc8 (faulty translation?)
more relevant examples: spell: 50246, 50242 are named '01001000', '1000001' which is interpreted as octal notation
aowow/includes/components/dbtypelist.class.php
Lines 174 to 185 in 830edb8
| } | |
| else if (Util::checkNumeric($c[1])) // Note: should this be a NUM_REQ_* check? | |
| { | |
| $op = (isset($c[2]) && $c[2] == '!') ? '<>' : '='; | |
| $val = $c[1]; | |
| } | |
| else if (is_string($c[1])) | |
| { | |
| $op = (isset($c[2]) && $c[2] == '!') ? 'NOT LIKE' : 'LIKE'; | |
| $val = DB::Aowow()->escape($c[1]); | |
| } | |
| else if (count($c) > 1 && $c[1] === null) // specifficly check for NULL |
The resulting sql query thus compares varchar to int, which causes mysql warning 1292:
Truncated incorrect DECIMAL value: <cell Content>
There should be no type coercion happening when transforming the conditions. If a numeric string gets passed, that is still a string and should be treated as such.
todo: check occurrences of new \w+List\( for condition type conformity
- 80/278 in endpoints
- 0/60 in includes
- 0/21 in setup
- 0/8 occurrences of
Type::newList\(
note: the content of arrays is also coerced, which shouldn't be done either as it does nothing. (at last it's not actively causing issues)