Path comparison (e.g. for block visiblity) doesn't work for aliased internal paths with capital letters (block_block_list_alter() in D7)

Created on 17 November 2015, about 9 years ago
Updated 12 February 2024, 10 months ago

Problem/Motivation

Path comparison (e.g. for block visiblity) doesn't work for aliased internal paths / routes with capital letters for D7 (see block_block_list_alter() function). And D8 + 9 are affected, too.

Both sides of the string comparison must be lowercased, but the (system) path isn't lowercased.

Steps to reproduce

  1. Create an internal path (e.g. for a Views page or with hook_menu()) that contains at least 1 capital letter.
  2. Create an URL alias for that path.
  3. Enter the internal path as visibility page for any block and check that the block visibilty doesn't work as expected.

Proposed resolution

For the comparison of the aliased path everything is fine. But in the 2nd comparison with the internal path there is a missing drupal_strtolower() call for the internal path ($_GET['q']).

For D9 the file /core/modules/system/src/Plugin/Condition/RequestPath.php must be changed from
return $this->pathMatcher->matchPath($path_alias, $pages) || (($path != $path_alias) && $this->pathMatcher->matchPath($path, $pages));
to
return $this->pathMatcher->matchPath($path_alias, $pages) || (($path != $path_alias) && $this->pathMatcher->matchPath(mb_strtolower($path), $pages));

The D7 bugfix is a change in the https://api.drupal.org/api/drupal/modules%21block%21block.module/functio... file from
$page_match = $page_match || drupal_match_path($_GET['q'], $pages);
to
$page_match = $page_match || drupal_match_path(drupal_strtolower($_GET['q']), $pages);

Remaining tasks

  • review existing patch
  • backport for D7

User interface changes

none

API changes

...?

Data model changes

...?

Release notes snippet

...?

Original report by [M_Z]

Short description of the problem: both sides of the string comparison must be lowercased, but the (system) path isn't lowercasedโ€ฆ

D7 + D8 are affected by this bug.

-----

API page: https://api.drupal.org/api/drupal/modules%21block%21block.module/functio...

When the path patterns are compared with the current path the block_block_list_alter() function says:

// Compare the lowercase internal and lowercase path alias (if any).

For the comparison of the aliased path everything is fine. But in the 2nd comparison with the internal path there is a missing drupal_strtolower() call for the internal path ($_GET['q']).

So the bugfix would be an easy replacement of the line
$page_match = $page_match || drupal_match_path($_GET['q'], $pages);
with
$page_match = $page_match || drupal_match_path(drupal_strtolower($_GET['q']), $pages);
.

Or is there any mechanism that "auto"-lowercases $_GET['q']? I don't know such a mechanism...

To reproduce the bug create an internal path (e.g. for a Views page or with hook_menu()) that contains at least 1 capital letter. Create an URL alias for that path. Enter the internal path as visibility page for any block and check that the block visibilty doesn't work as expected.

๐Ÿ› Bug report
Status

Needs work

Version

11.0 ๐Ÿ”ฅ

Component
Blockย  โ†’

Last updated 2 days ago

Created by

๐Ÿ‡ฉ๐Ÿ‡ชGermany M_Z

Live updates comments and jobs are added and updated live.
  • Needs backport to D7

    After being applied to the 8.x branch, it should be considered for backport to the 7.x branch. Note: This tag should generally remain even after the backport has been written, approved, and committed.

  • Needs issue summary update

    Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.

  • Novice

    It would make a good project for someone who is new to the Drupal contribution process. It's preferred over Newbie.

Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024