[RFC] buggy function banned user ids

[3Di]

Working on an extension I noticed there is a glitch within a phpBB function, see:
phpBB 3.2.1 -> includes/functions_user.php

line #3647 as it is now (SQL report: Impossible WHERE noticed after reading const tables)

Code: Select all

$sql_user_ids = (!empty($user_ids)) ? $db->sql_in_set('ban_userid', $user_ids) : 'ban_userid <> 0';

Should read

Code: Select all

$sql_user_ids = (!empty($user_ids)) ? $db->sql_in_set('ban_userid', $user_ids) : 'ban_userid <> 1';

And that's normal with a normal installation, the constant ANONYMOUS instead produces a SQL error.

If confirmed I will be more than glad to push a request.


What about if an user for some reason changed that constant during the life of its board?
Say a conversion or an upgrade from phpBB 1/2 ?

[kasimi]

0 is the correct value here because the query is selecting banned users, as opposed to banned emails or IPs for which ban_userid whould be 0. If you change it to <> 1, the returned array contains an invalid entry.