Fixed XF\Http\Request: Non-array-like JSON input triggers PHP error

[Steffen]

Affected version

2.3.7

To reproduce, send JSON input to XenForo that PHP's json_decode function does not turn into an array (but into a string/int/boolean/...). For example:

curl -X POST -H "Content-Type: application/json" -d "true" https://xenforo.com/community/

Then XF\Http\Request::getPhpInputJson returns a scalar value (instead of an array) which causes the following error in XF\Http\Request::__construct:

Uncaught TypeError: Unsupported operand types: array + bool in src/XF/Http/Request.php:912

Possible fix:

--- a/src/XF/Http/Request.php
+++ b/src/XF/Http/Request.php
@@ -963,7 +963,8 @@ class Request
            $rawInput = @file_get_contents("php://input");
            if ($rawInput)
            {
-               return json_decode($rawInput, true) ?: [];
+               $json = json_decode($rawInput, true);
+               return is_array($json) ? $json : [];
            }
        }

 

[XF Bug Bot]

Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.3.8).

Change log:

Fix TypeError when non-array JSON input is submitted (#1223)

There may be a delay before changes are rolled out to the XenForo Community.