Re: "Three Strikes You're Out" rule fails
Available news archives: comp.lang.tcl - comp.lang.python - comp.security.firewalls - sci.crypt - comp.lang.php - comp.lang.javascript
Google
 
Web news.hping.org


comp.lang.php archive

Re: "Three Strikes You're Out" rule fails

From: David Haynes <david.haynes2@sympatico.ca>
Date: Tue Mar 28 2006 - 03:39:39 CEST

Oli Filth wrote:
> comp.lang.php said the following on 27/03/2006 16:55:
>> print_r("Before: "); print_r($_SESSION["${projectAcronym}_kounter"]);
>> print_r("<P>");
>> if (is_array($_POST) && @sizeof($_POST) > 0 && is_object($accepter)
>> && @is_a($accepter, 'Accepter') && is_object($ap) && @is_a($ap,
>> 'ActionPerformer') &&
>> (!$accepter->isValid || !$ap->isSuccessful) &&
>> (int)$_SESSION["${projectAcronym}_kounter"] >= 1
>> ) {
>> foreach ($_SESSION as $field) if (strpos($field, $projectAcronym)
>> === 0) unset($_SESSION[$field]);
>> $qs = '?sort=' . $_REQUEST['sort'] . '&willDesc=' .
>> $_REQUEST['willDesc'] . '&willShowDetail=1&id=' . $_REQUEST['id'];
>> $errorMsg = "<p><font color=\"#cc0000\"><b>Application display
>> restarted due to too many errors, all values reset</b></font></p>";
>> $qs .= '&errorMsg=' . urlencode($errorMsg);
>> header('Location: ' . $_SERVER['PHP_SELF'] . $qs);
>> } elseif (is_array($_POST) && @sizeof($_POST) > 0 &&
>> is_object($accepter) && @is_a($accepter, 'Accepter') && is_object($ap)
>> && @is_a($ap, 'ActionPerformer') &&
>> (!$accepter->isValid || !$ap->isSuccessful) &&
>> (int)$_SESSION["${projectAcronym}_kounter"] >= 0
>> ) {
>> if ((int)($_SESSION["${projectAcronym}_kounter"]) > 0)
>> (int)$_SESSION["${projectAcronym}_kounter"]++; else
>> $_SESSION["${projectAcronym}_kounter"] = 1;
>> }
>> print_r("After: ");
>> print_r($_SESSION["${projectAcronym}_kounter"]); print_r("<P>");
>> //--END OF "Three Strikes You're Out"
>
> That's some of the most unreadable code I've ever seen.
>
>
It's still obtuse if you do reformat it...
My comments with '--' prefix.

print_r("Before: ");
print_r($_SESSION["${projectAcronym}_kounter"]);
print_r("<P>");

if(
        is_array($_POST)
        && @sizeof($_POST) > 0
        && is_object($accepter)
        && @is_a($accepter, 'Accepter')
        && is_object($ap)
        && @is_a($ap, 'ActionPerformer')
        && ( ! $accepter->isValid || !$ap->isSuccessful )
-- up to here the two clauses of the if are identical
        && (int)$_SESSION["${projectAcronym}_kounter"] >= 1 ) {
-- if we get here, i.e. kounter > 0, then we never increment it
-- net result: the kounter goes from 0 in the second clause
-- and stays at one here - which is the observed result.
-- Also, the casts to int are not needed
        foreach( $_SESSION as $field)
                if( strpos($field, $projectAcronym) === 0 )
-- why ===? checking the return type of strpos for integer?
                        unset($_SESSION[$field]);

        $qs = '?sort='.$_REQUEST['sort']
                .'&willDesc='.$_REQUEST['willDesc']
                .'&willShowDetail=1'
                .'&id='.$_REQUEST['id'];
        $errorMsg = "<p><font color=\"#cc0000\">"
                ."<b>Application display restarted due to too many errors, all values
reset</b>"
                ."</font></p>";
        $qs .= '&errorMsg='.urlencode($errorMsg);
        header('Location: '.$_SERVER['PHP_SELF'].$qs);
} elseif(
        is_array($_POST)
        && @sizeof($_POST) > 0
        && is_object($accepter)
        && @is_a($accepter, 'Accepter')
        && is_object($ap)
        && @is_a($ap, 'ActionPerformer')
        && ( ! $accepter->isValid || !$ap->isSuccessful )
        && (int)$_SESSION["${projectAcronym}_kounter"] >= 0 ) {
-- the previous if clause will trap on kounter >= 1, so this test
-- should be == 0 if kounter has any chance of going negative
-- otherwise it is useless.
        if ((int)($_SESSION["${projectAcronym}_kounter"]) > 0)
                (int)$_SESSION["${projectAcronym}_kounter"]++;
        else
                $_SESSION["${projectAcronym}_kounter"] = 1;
-- so we know that kounter is always zero, to only this line will
-- be used, moving kounter to 1.
}
print_r("After: ");
print_r($_SESSION["${projectAcronym}_kounter"]);
print_r("<P>");
//--END OF "Three Strikes You're Out"

-david-
Received on Mon May 1 02:42:28 2006