Ok, this is for perfectionists! For most users this wouldn't be an issue.
How to simulate this:
1. Invite a user with a email with '+' in it. This according to rfcs are valid. So something like user+1@email.com is a perfectly valid email id
2. Now try deleting this invite
3. You'll get a message saying this is deleted, but the email will still be there
4. This is because, + in urlencode is translated as space thus the above email will be searched as user1@email.com which will fail in the sql query
Enough babble, where's the fix?
function invite_delete($email) {
global $user;
//RD: when email has + in it, that is equal to space in an encoded
//url. urlencode converts space to +
//rawurldecode does not convert + back to space thus preserving +
$email = urlencode($email);
$email = rawurldecode($email);
if ($email){
This should fix the problem. If the email doesn't have a + then this isn't an issue at all.
Comments
Comment #1
AjK commentedCommitted to DRUPAL-4-7 and DRUPAL-5. Thanks.
Comment #2
(not verified) commentedComment #3
AjK commentedThis patch/commit actually broke delete altogether and so was rolled back by http://drupal.org/node/113539
As it stands, the module is "a little" broken rather than totally broken regarding deletions. I don't have too much time to look at it now so suggestions/patches welcome.
Comment #4
knseibert commentedI can't reproduce this error in version 5. And version 4.7 of invite_delete() does not seem any different. Is this bug still active?
Comment #5
smk-ka commentedI can't either. Marking as fixed, as the current implementation seems to work flawlessly.
--
Stefan Kudwien
www.unleashedmind.com
Comment #6
(not verified) commented