PHP error in Forminator_Select::validate

  • Resolved peter8nss

    (@peter8nss)


    1 month, 1 week ago

    Noticed in my server log the following fatal PHP error:

    Uncaught TypeError: strlen(): Argument #1 ($string) must be of type string, array given in /home/sites/1a/4/44afcb079c/public_html/wp-content/plugins/forminator/library/fields/select.php:586\nStack trace:\n#0 /home/sites/1a/4/44afcb079c/public_html/wp-content/plugins/forminator/library/abstracts/abstract-class-field.php(893): Forminator_Select->validate(Array, Array)\n#1 /home/sites/1a/4/44afcb079c/public_html/wp-content/plugins/forminator/library/modules/custom-forms/front/front-action.php(622): Forminator_Field->validate_entry(Array, Array)\n#2 /home/sites/1a/4/44afcb079c/public_html/wp-content/plugins/forminator/library/modules/custom-forms/front/front-action.php(570): Forminator_CForm_Front_Action::set_field_data('select-1', Array, 4)\n#3 /home/sites/1a/4/44afcb079c/public_html/wp-content/plugins/forminator/library/modules/custom-forms/front/front-action.php(501): Forminator_CForm_Front_Action::set_field_data_array(4, Object(Forminator_Form_Field_Model))\n#4 /home/site...'

    “select-1” is a select field from which I would normally expect to get back a string. I think someone has tried to inject an array into this field causing this PHP error in function Forminator_Select::validate.

    I don’t think the “is required” checking can assume that just because it is processing a “single” that a string has actually been supplied. Initially, I thought “empty” could be used to cover both “single” and “multiselect” cases, but that wouldn’t work if one of the select options was “0”. So perhaps something like the following would be a bit more bulletproof:

    if ( $this->is_required( $field ) ) {
       if ( ! isset( $data ) ||
          ( 'single' === $select_type && ! ( is_string( $data ) && strlen( $data ) > 0 ) ) ||
          ( 'multiselect' === $select_type && empty( $data ) )
Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Support Amin – WPMU DEV Support

    (@wpmudev-support2)

    Hello @peter8nss

    Hope you are doing well today.

    The error does not show any clue of a hacker attack it could be due to a bug or code conflict but you are right we can do more checks for that field data.

    I will bring your issue to our development team to review and investigate further, since it’s a rare error I believe it will not happen again so you can ignore it for now, we will try to improve the plugin in future updates.

    Kind Regards,
    Amin

    Plugin Support Nithin – WPMU DEV Support

    (@wpmudevsupport11)

    Hi @peter8nss,

    Since we haven’t heard from you for a while. I’ll mark this thread as resolved for now. Please feel free to re-open this thread if you need any further assistance.

    Kind Regards
    Nithin

    Thread Starter peter8nss

    (@peter8nss)

    I have seen these recur on a number of occasions (most recent on 5th November). In all cases the IP address suggests it is not one of my users, e.g. it is hackers, allbeit unsuccessful AFAIK.

    Hello @peter8nss,

    I hope things are going well for you.

    Would you mind sharing more the form export file and site info? so we can review further on that?

    For the form export you can follow this guide:-https://wpmudev.com/docs/wpmu-dev-plugins/forminator/#import-export and kindly refer this screenshot for copy site info:-
    https://monosnap.com/file/dP0SsOYhF7tyw7dO8eGDbm9UUKkpHY

    You can share both using public platform such as using?pastebin.com. In case you would like to share it privately, send an email to?[email protected]?with this specific subject:?ATTN: WPMU DEV support-wp.org.?In the email body, include the form URL and the thread link:?https://www.ads-software.com/support/topic/php-error-in-forminator_selectvalidate/.

    I hope to hear from you soon

    –
    Thanks & Kind Regards,
    Imran Khan

    Thread Starter peter8nss

    (@peter8nss)

    I have replied using the email.

    My guess is that some “bot” is programatically trying to submit the form and providing an array of select values rather than the single one that the form would get if used by a human.

    So, whilst your code is correct for normal usage, it has not considered a programatic form submit. Hence, my suggested change to make the code fail gracefully in this case.

    Plugin Support Patrick – WPMU DEV Support

    (@wpmudevsupport12)

    Hi @peter8nss

    Thank you for the form,

    I made a few tests on my lab site and attempted to simulate an attack passing different parameter types to select-1 but none resulted in the fatal error. But I can see based on your logs we could improve it.

    I’ve reported this to our developers.

    Note, that we can’t give any estimated time or guarantee we will add the additional validation as it also requires finding the replication steps, but please keep the plugin updated and if you would like to follow our updates you can subscribe to https://wpmudev.com/roadmap#dev-subscribe

    Best Regards
    Patrick Freitas

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.