MFH: Fixed bug #42718 (FILTER_UNSAFE_RAW not applied when configured as

default filter)

NEWS

@@ -26,6 +26,8 @@ PHP                                                                        NEWS
 - Fixed bug #43452 (strings containing a weekday, or a number plus weekday
   behaved incorrect of the current day-of-week was the same as the one in the
   phrase).(Derick)
+- Fixed bug #42718 (FILTER_UNSAFE_RAW not applied when configured as default
+  filter). (Arnaud)
 - Fixed bug #42294 (Unified solution for round() based on C99 round). (Ilia)
 
 - Fixed ability to use "internal" heaps in extensions. (Arnaud, Dmitry)

ext/filter/filter.c

@@ -403,7 +403,7 @@ static unsigned int php_sapi_filter(int arg, char *var, char **val, unsigned int
 		Z_STRLEN(new_var) = val_len;
 		Z_TYPE(new_var) = IS_STRING;
 
-		if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)) {
+		if (IF_G(default_filter) != FILTER_UNSAFE_RAW || IF_G(default_filter_flags) != 0) {
 			zval *tmp_new_var = &new_var;
 			Z_STRVAL(new_var) = estrndup(*val, val_len);
 			INIT_PZVAL(tmp_new_var);

ext/filter/tests/bug42718-2.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #42718 - 2 (unsafe_raw filter not applied when configured as default filter)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--INI--
+magic_quotes_gpc=1
+filter.default=unsafe_raw
+filter.default_flags=
+--GET--
+a=1%00
+--FILE--
+<?php
+echo ini_get('filter.default') . "\n";
+echo ini_get('filter.default_flags') . "\n";
+echo addcslashes($_GET['a'],"\0") . "\n";
+?>
+--EXPECT--
+unsafe_raw
+
+1\0

ext/filter/tests/bug42718.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #42718 (unsafe_raw filter not applied when configured as default filter)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--INI--
+magic_quotes_gpc=0
+filter.default=unsafe_raw
+filter.default_flags=4
+--GET--
+a=1%00
+--FILE--
+<?php
+echo ini_get('filter.default') . "\n";
+echo ini_get('filter.default_flags') . "\n";
+var_dump(FILTER_FLAG_STRIP_LOW == 4);
+echo addcslashes($_GET['a'],"\0") . "\n";
+?>
+--EXPECT--
+unsafe_raw
+4
+bool(true)
+1