not sure if this fixes it #621512: Domain validation allows improper characters but if you go to admin/build/domain/batch/subdomain one can enter in uppercase domain names & it will take it. Generally a bad idea, they should be checked for uppercase like you currently do on the alias page (admin/build/domain/alias/1).

Comments

agentrickard’s picture

Looks like we need a case in domain_batch_validate() for domain_subdomain(). Run each through domain_valid_domain() maybe?

You want to try a patch?

agentrickard’s picture

Status: Active » Needs review
StatusFileSize
new1.29 KB

Here's one.

mikeytown2’s picture

I have yet to run the patch but what about the domains that are already in the database? We need some sort of check or update all to be lowercase; I have some uppercase domains currently in my database, it's how I found the bug. Will test later today.

agentrickard’s picture

The update function would be pretty simple.

agentrickard’s picture

Oddly, we don't validate for UPPER case right now, except in Domain Alias.

agentrickard’s picture

StatusFileSize
new1.89 KB

Removing a 'i' from the regex.

agentrickard’s picture

StatusFileSize
new1.86 KB

And removing the debug.

agentrickard’s picture

Doing this might interfere with people transliterating Internationalized Domain Names.

mikeytown2’s picture

Have you had any complaints about Domain Alias not working with i18n? I do know that in RFC 819 it says

The simple names that make up a domain may contain both upper and
lower case letters (as well as digits and hyphen), but these names
are not case sensitive.

When doing a query MySQL & case sensitive can cause odd results. Drupal will force the HTTP_HOST to lowercase

http://api.drupal.org/api/function/conf_init/6

function conf_init() {
...
  if (isset($_SERVER['HTTP_HOST'])) {
    // As HTTP_HOST is user input, ensure it only contains characters allowed
    // in hostnames. See RFC 952 (and RFC 2181).
    // $_SERVER['HTTP_HOST'] is lowercased here per specifications.
    $_SERVER['HTTP_HOST'] = strtolower($_SERVER['HTTP_HOST']);
    if (!drupal_valid_http_host($_SERVER['HTTP_HOST'])) {
      // HTTP_HOST is invalid, e.g. if containing slashes it may be an attack.
      header('HTTP/1.1 400 Bad Request');
      exit;
    }
  }
...

So IMHO you should force it to be lowercase since drupal does the same thing to HTTP_HOST

agentrickard’s picture

Right. I would agree. But IDN splits off from that spec and tries to establish a new one. I think the transliterated versions are still all lower case.

mikeytown2’s picture

I don't run any i18n sites so I can't answer this question; but this is what I found on wikipedia.
http://en.wikipedia.org/wiki/Internationalized_domain_name#ToASCII_and_T...
http://en.wikipedia.org/wiki/Nameprep

Long story short, looks like it's lowercased.

agentrickard’s picture

Excellent. I think I may sneak in a domain_validate_alter() hook into this patch as well, just in case.

agentrickard’s picture

StatusFileSize
new4.57 KB

Patch, with update function and alter hook. Looks RTBC to me, then we get 6.x.2.5....

mikeytown2’s picture

Status: Needs review » Needs work

hook_domain_validate_alter() - Cool!

update works.
admin/build/domain/batch/subdomain when entering in an uppercase domain, validation fails (good) but then all domains get set to red; making it hard to find which domain failed validation (bad).
Other then this interface formapi issue, looks good to me.

mikeytown2’s picture

Status: Needs review » Needs work

actually thinking about this... for utf8 i18n domains the regex will fail since you only allow [a-z0-9\.\-:]. The only safe way to test for uppercase IMHO would be a string comparison. Take the original string and see if it matches the mb_strtolower version. Something like this

if (strcmp($subdomain, mb_strtolower($subdomain, mb_detect_encoding($subdomain))) != 0) {
  // $subdomain contains uppercase letters
}

EDIT: you just might want to stick with strtolower since that is what core uses...
EDIT2: and in this case strtolower is pointless since the regex will catch the uppercase characters.

agentrickard’s picture

I'm not sure I can fix the form error message. This is an issue with the general batch handling and #TREE.

Where are you suggesting we make the string check change? Probably after this regex?

  // Check for valid characters
  $pattern = '/^[a-z0-9\.\-:]*$/i'; // DO WE RETAIN THE 'i' here?
  if (!preg_match($pattern, $subdomain)) {
    $error_list[] = t('Only alphanumeric characters, dashes, and a colon are allowed.');
  }
  // Check uppercase
  if (strcmp($subdomain, strtolower($subdomain)) != 0) {
    $error_list[] = t('Domain contains uppercase letters');
  }
mikeytown2’s picture

Status: Needs work » Reviewed & tested by the community

This still will only allow domains with a-zA-Z
http://blog.icann.org/2010/05/idn-cctlds/
The game changed 2 days ago. Only works in safari from what I can tell.

i18n is a different issue. If #TREE can't be fixed then this is RTBC from my point of view.

agentrickard’s picture

Status: Reviewed & tested by the community » Needs review

I thought we wanted to remove the case-sensitivity?

agentrickard’s picture

StatusFileSize
new5.26 KB

I can, in fact, indicate which domains fail.

mikeytown2’s picture

Status: Needs work » Needs review

I thought we wanted to remove the case-sensitivity?

Thats why you got rid of the i in the regex below.

   // Check for valid characters
-  $pattern = '/^[a-z0-9\.\-:]*$/i';
+  $pattern = '/^[a-z0-9\.\-:]*$/';

This will now throw an error if $subdomain contains an uppercase character. What I was talking about in #15 (see newly added EDIT2 remark) has to do with non ascii domains. Both versions of this regex will flag them (idn domains) as invalid, but on May 5th (use safari for link in blog) ICANN now allows non ascii domains. This (idn domains) is a different issue, one that Drupal does not currently address AFAIK.

Last patch I tested (#13) fixed the bug addressed in this issue. I can test #19 sometime next week; but if you tested the #TREE indicator and it works, then I think that patch is RTBC.

Thanks for getting this one out :)

agentrickard’s picture

I think for non-ascii domains, we allow the use of the alter hook.

agentrickard’s picture

StatusFileSize
new5.61 KB

New patch version, which allows the setting of the variable domain_allow_non_ascii in settings.php. If TRUE, the ASCII check is bypassed. Moved the lowercase check to its own step and tested successfully with the sample IDN mentioned here.

http://blog.icann.org/2010/05/idn-cctlds/

nonsie’s picture

Status: Needs review » Needs work

Initial review - works for batch pages however ASCII validation is bypassed on domain edit form.
Imagine the following scenario:
1. domain_allow_non_ascii is enabled
2. domains are added
3. domain_allow_non_ascii is disabled
4. any edits to domains added in #2 will not fail if the domain name is not changed.

Do we care enough to trigger validation each time domain is updated even when the domain name is not or should it be an item in README.txt?

Also domain add/edit form should indicate if ASCII characters are allowed in the domain name.

agentrickard’s picture

We should trigger validation any time example.com is edited. ASCII on/off should be noted.

nonsie’s picture

I tried removing the name change condition and always calling domain_validate() in domain_form_validate() however this function calls domain_unique_domain() which will return false since there is already a domain with such name. Not sure how to best approach this problem without rewriting big chunks of code or adding an additional parameter to domain_unique_domain()

nonsie’s picture

Status: Needs work » Needs review
StatusFileSize
new7.6 KB

This should do it.

agentrickard’s picture

Version: 6.x-2.4 » 7.x-2.x-dev
Status: Needs review » Needs work
StatusFileSize
new10.14 KB

Nice work, everyone. Documentation added and committed to 6--2.

agentrickard’s picture

Status: Needs work » Fixed
StatusFileSize
new9.11 KB

Committed to D7.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.