Too long names lead to a crash
If you vote on a survey with a very long name, you will not get an error message, but a SQL error occurs because the name is too long for the database.
Fatal error: Uncaught PDOException: SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'name' at row 1 in /var/www/framadate/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOStatement.php:117 Stack trace: #0 /var/www/framadate/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOStatement.php(117): PDOStatement->execute(Array) #1 /var/www/framadate/vendor/doctrine/dbal/lib/Doctrine/DBAL/Connection.php(1058): Doctrine\DBAL\Driver\PDOStatement->execute(Array) #2 /var/www/framadate/vendor/doctrine/dbal/lib/Doctrine/DBAL/Connection.php(775): Doctrine\DBAL\Connection->executeUpdate('INSERT INTO fd_...', Array, Array) #3 /var/www/framadate/app/classes/Framadate/Repositories/VoteRepository.php(45): Doctrine\DBAL\Connection->insert('fd_vote', Array) #4 /var/www/framadate/app/classes/Framadate/Services/PollService.php(167): Framadate\Repositories\VoteRepository->insert('yugQIqbSwoZVihq...', 'AAAAAAAAAAAAAAA...', '0000', 'MLMcgtDli51lrkP...', NULL) #5 /var/www/framadate/studs.php(175): Framadate\Services\PollS in /var/www/framadate/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/AbstractMySQLDriver.php on line 106
If you take a look at the table fd_vote
, you'll see:
+---------+--------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------+--------------+------+-----+---------+----------------+
| id | int(11) | NO | PRI | NULL | auto_increment |
| poll_id | varchar(64) | NO | MUL | NULL | |
| name | varchar(255) | NO | | NULL | |
| choices | varchar(255) | NO | | NULL | |
| uniqId | varchar(16) | NO | MUL | NULL | |
| mail | varchar(255) | YES | | NULL | |
+---------+--------------+------+-----+---------+----------------+
Since the name field is limited to 255 characters, a simple check in studs.php:165
should fix that issue:
if ($name === null || strlen($name) > 255) {
$message = new Message('danger', t('Error', 'The name is invalid.'));
}