|
|
I'm wondering if this could potentially cause PMs to fail to send without any "notice" to the user depending on the DB's configuration, come to think about it. This could actually be more of an issue than it looks to be at the moment given the lack of proper error handling. |
|
|
Yep, just checked and if strict mode is turned on (which is actually the default ever since MySQL 5.7/8.0+ and MariaDB 10.2+ I believe), you'd instead get a "data too long" error and the U2U would fail to send. Running debug mode on production and exposing errors to users is also... less than ideal, too. |
|
|
There are a bunch of different issues here. Mainly, XMB needs stronger input validation. This problem applies to every database field that accepts user input. They can all throw the same warnings and errors. The MySQL server we are using here does not have strict mode enabled. It can be switched at runtime for testing, but I don't think it's a huge issue. The error handling was already addressed in 0000685. Patching the U2U subject and body fields might be adequate for now, but I think this issue should be examined more before doing that. |
|
|
With strict mode enabled it just outputs a data too long error (if I'm remembering right) in debug mode, or silently fails in non-debug mode. Tbh the fact the software even holds up so well DB-compatibility aside from a rather minor issue is actually really impressive, I've seen more active projects that would break entirely when STRICT_TRANS_TABLES was made default mode in MySQL 5.7/MariaDB 10.2 |
|
|
Correction. It truncates the subject even in strict mode. However, the limit being so liberal also allows you to do stuff like this, which isn't particularly ideal especially on mobile devices. oh god.png (135,058 bytes) |
|
|
That screenshot is off topic. We already have input validation for that one. |
|
|
Best examples are the AIM field (40 chars) and the bday field (10 chars). For some reason it's still possible to input a year greater than 9999. We only filter years less than 1900. |
|
|
I mean, the AIM field can be axed at this point, given AIM is dead. Fair enough, though. |
- Anonymous
