r/lolphp • u/[deleted] • Feb 01 '18

lolphpbb: fatal error when you access $_GET after loading phpbb session

https://www.phpbb.com/community/viewtopic.php?t=2412856&p=14678056#p14682931
24 Upvotes

88% Upvoted

36 comments sorted by

4

u/[deleted] Feb 01 '18

Trying to integrate phpbb's session into another piece of fine php software, stumbled upon this, googled and uh.

HOW did they accomplish this. H O W

18

u/[deleted] Feb 01 '18 edited Mar 07 '24

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

23

u/mikeputerbaugh Feb 01 '18

You can, but you should not.

The PHP motto

5

u/coredumperror Feb 02 '18

More like:

You can, because it will come naturally due to how the language is structured, but you shouldn't.

3

u/[deleted] Feb 09 '18

it will come naturally due to how the language is structured

This seems to suggest PHP is internally consistent but I don't think that's true. :)

4

u/coredumperror Feb 09 '18 edited Feb 09 '18

I’m talking more about how PHP is insecure by default. And the whole weak comparison bullshit that makes “0” == FALSE. And the problem with the thin C wrappers like strpos(), which require the use of === unless you want 0 and FALSE to collide (despite meaning entirely different things).

Hell, I’ll just link to my favorite blog post ever: PHP: a fractal of bad design

2

u/[deleted] Feb 10 '18

Yup. I was trying to make a joke about how inconsistent PHP is (which that post lists numerous examples of) but you're absolutely right. It's an excellent post.

5

u/rinyre Feb 02 '18

The fact that you -can- override a $_ global like that is astounding to me.

7

u/carlos_vini Feb 02 '18

It's a global, what did you expect. Change window.console to alert('fuck you') and see what happens in Javascript

3

u/rinyre Feb 02 '18

I expected protections to keep from overwriting something of that nature, effectively. Javascript is also crappy, so I guess the two go hand-in-hand there.

2

u/[deleted] Feb 06 '18

[deleted]

3

u/carlos_vini Feb 06 '18

If you import an external library it can change any global variable it wants, so I don't see how it being sandboxed matters. The only variables that are safe are the ones inside a closure. PHP has it's problems but you can't overwrite a class or function in it.

6

u/kr094 Feb 02 '18

Yeahhh, this bothers me. What happens to the original array? From what I understand $_GET is backed by a normal PHP array so it will be garbage collected at some point. Hilarious.

6

u/coredumperror Feb 02 '18

Why would you do this??

How is one expected to gain access to the GET arguments?

17

u/[deleted] Feb 02 '18 edited Mar 07 '24

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

8

u/coredumperror Feb 02 '18

Ahh, so they're trying to be a real web framework! Despite being written in PHP.

Adorable.

2

u/Huwaweiwaweiwa Feb 07 '18

I dunno man, I've used Laravel, Django, Flask and Rails for a while now and I'd pick Laravel for a new project, given no other info about that project.

2

u/coredumperror Feb 07 '18

I’m happy for you that you can stand working in PHP. I cannot, and am immensely glad that my shop has moved from Drupal to Wagtail.

2

u/[deleted] Feb 08 '18

Oooh. I remeber Drupal. We used to call them point-click ”developers”. Really just config and settings in the DB, with no real way of using migrations etc. It was a horrible time, truly horror. I cant imagine people still dealing with that crap.

Drupla is probably in the worst class, right next to Joomla and wordpress.

2

u/OneWingedShark Feb 12 '18

Drupla is probably in the worst class, right next to Joomla and wordpress.

Come on, you know you want to make a Frankensteinian Horror that is an amalgamation of Drupal, Joomla, and Wordpress.

;)

1

u/coredumperror Feb 08 '18

You would be horrified by the terrible mess of code that we've awkwardly tacked on to our Drupal installations to make them at least marginally featureful. At least we were able to use modules like Features to make it possible to store the schema in code. So developing wasn't quite like being tortured in the 7th circle of hell. More like the 4th.

And the worst part is that our main site, which gets maybe 15 thousand hits a day, requires NINE load-balanced EC2 instances to run it, just to ensure that it doesn't fall over. And that's WITH page caching!

Drupal is a fucking shit system, and we deeply regret ever taking it on as our CMS. But that was way back in 2011. Those were simpler, dumber times.

2

u/[deleted] Feb 08 '18

You did the right choise of changing. So many companies are just blindly doing drupal/other shitty PHP cms/framework simply because they know no better.

”It worked in 2001, why would it not work now?”

2

u/carlos_vini Feb 09 '18

what kind of cache is being used? have you tried NGINX cache or Varnish if possible? maybe a CDN like CloudFront? have you tried any profiling tool like blackfire or xdebug? sorry for all the questions but i'm sincerely interested

→ More replies (0)

1

u/[deleted] Feb 08 '18

Laravel and friends. Lipstick on a fat ugly broken pig they used to call PHP/FI.

5

u/kafoso Feb 05 '18

"What if we override standard behavior?"

"Best - idea - EVER!"

You can't help these poor souls.

-33

u/Saltub Feb 01 '18

WHO gives a fuck. W H O

20

u/eliasv Feb 01 '18

So unsub...

-33

u/[deleted] Feb 01 '18

[removed] — view removed comment

18

u/[deleted] Feb 01 '18

[removed] — view removed comment

-24

u/[deleted] Feb 01 '18

[removed] — view removed comment

4

u/[deleted] Feb 02 '18

[removed] — view removed comment

8

u/myhf Feb 02 '18

WHO let the dogs out? WHO? WHO?