[RSS Feed/News] Buggy string comparisons

[XenForo]

In PHP, some comparisons with == or in_array may return true when the programmer expects them to return false. For example, "00" == "0000" is true in PHP, as is in_array("00", ["0000"]). XenForo 2 performs loose comparisons in some places that can potentially result in bugs:

• XF\Criteria\User#_matchUsername: lax in_array usage will result in usernames like 010 matching usernames like 10 and...

Read more

ادامه مطلب...