contao/test — Issue #1097: Insufficient character class in RegEx test inside Widget class
Author: importer
Created: 2011-11-29 07:21:17+00:00
State: open
Labels: backend, Defect

If mb_string is disabled, simple RegEx test is performed to validate strings. As the result, some fields in a back end do not validate. It's impossible to save anything including pages, articles and form fields. I would classify this bug as a extremely severe with a strong influence on system usability.

For alphabetic and alphanumeric strings patters '/^[\pL \.-]**$/u' and '/^[\pN\pL \._-]**$/u' are used accordingly. These patters however are wrong because they narrow character class to UTF-8 encoded letters (and numbers), space, full stop and dash. Please note, the class does not include any single byte encoded letters (or numerals). In PECL dialect \pL and a-z are not the same!

The correct fix seems to be fairly easy - I would suggest to change alphabetic testing pattern to '/^[a-z\pL\s\.-]**$/iu' and alphanumeric to '/^[a-z0-9\pN\pL\s\._-]**$/iu'. Well, it's what I did for the time the fix comes and it works fine. Please note I also added case insensitivity modifier and changed space to white-space shorthand \s which will allow multi-line strings to be tested too.

Hope that helps.

Thanks,

Arthur Bezner

[Download the attachments](http://www.contao.org/tl_files/tickets/1097.zip "Download the attachments of this ticket")

--- _Originally created by bezner on October 15th, 2009, at 12:44am (ID 1097)_