Illegal use of $_GET - phpbb 3.2.x - how to use $request

[catwiesel]

Hello,

I am currently writing a small homepage, which will use the user authentication of phpbb. This is NOT an extension and it will not use more from phpbb.
Maybe, very far down the line, I may want to generate text and save that as a draft in phpbb.

Anyway,

I try to use GET to switch between my sites (for example index.php?site=1 or ?site=2) to view different content.
This seems not to work since I use phpbb authentication and therefore have to load some stuff from phpbb.

I know that it would work if I enable super globals. I understand that I actually could do that for my website, since it is not an actual extension.
However, you guys made an effort to make security better, and why not keep that?

I did some research and found that I am supposed to use the $request.
I found examples for $_SERVER, I found lengthy discussion about people trying different permutations, but not on GET.

like: viewtopic.php?f=461&t=2310166

$path = $_SERVER['DOCUMENT_ROOT']; --> $path = $request->server('DOCUMENT_ROOT', '');

I found so much, and it helped very little.

I ask for a very simple line of code, which I will have to use to get to my $_GET

I tried: $site = $request->get('site','');

I would also be interested in a more verbose explanation on how/why the correct line of code works. But I dont require it.

Thank you in advance!
Catwiesel

[canonknipser]

I tried: $site = $request->get('site','');

For your case
$site = $request->variable('site', 1);
should work (the 1 will be the default when no value was given).
But you need to have the phpBB initialization code in your script (see any core script in the phpBB root folder, eg. https://github.com/phpbb/phpbb/blob/mas ... hp#L17-L27 ):

Find some other examples for variables passed to the script in the following lines: https://github.com/phpbb/phpbb/blob/mas ... hp#L28-L33

You can check the complete class in the api documentation; you may be interested in the "variable" method

[catwiesel]

thank you!

I do have the initialization code loaded. otherwise I could not use the phpbb userdate. furthermore, it should not block me from using $_GET

I will test this and look at the documentation tomorrow. I now must drink beer and play a game

[catwiesel]

$site = $request->variable('site', 1);

It works.

I noticed something though.

When you set the default to an integer, the variable will always be an integer.
If you put it in quotes and therefore as a string, you also can use strings.

?site=admin wont work with ('site',1)
?site=2 will work with ('site',1)

?site=admin will work with ('site','1');


Again, thank you!

[canonknipser]

When you set the default to an integer, the variable will always be an integer.
If you put it in quotes and therefore as a string, you also can use strings.

From your example in the opening post, I assumed you wanted a parameter of integer value

I forgot to mention the coding guidelines which reference this behaviour: https://area51.phpbb.com/docs/32x/codin ... ml#general

The $request->variable() method determines the type to set from the second parameter (which determines the default value too). If you need to get a scalar variable type, you need to tell this the variable() method explicitly

and the development documentation as a general overview: https://area51.phpbb.com/docs/dev/

[catwiesel]

From your example in the opening post, I assumed you wanted a parameter of integer value

I forgot to mention the coding guidelines which reference this behaviour: https://area51.phpbb.com/docs/32x/codin ... ml#general

Don't feel bad. I am very grateful to get the working line and it was only a matter of testing twice to get the string working.

Thanks for the coding guidelines, too.

[Toxyy]

$site = $request->variable('site', 1);

It works.

I noticed something though.

When you set the default to an integer, the variable will always be an integer.
If you put it in quotes and therefore as a string, you also can use strings.

?site=admin wont work with ('site',1)
?site=2 will work with ('site',1)

?site=admin will work with ('site','1');


Again, thank you!

In posting.php mode=reply/comment/quote is formatted like

Code: Select all

$mode = $request->variable('mode', '');