From: Gergő Tisza <tgr.huwiki@gmail.com>
Date: Thu, 24 Mar 2016 18:22:45 +0000 (+0100)
Subject: Throw an exception when the $key argument to hash_hmac is not a string
X-Git-Tag: 1.31.0-rc.0~7517^2
X-Git-Url: http://git.cyclocoop.org/%22.htmlspecialchars%28%24url_syndic%29.%22?a=commitdiff_plain;h=f15faf646371e13c9fd0acaf066f153965440648;p=lhc%2Fweb%2Fwiklou.git

Throw an exception when the $key argument to hash_hmac is not a string

HHVM throws a fatal error when $key is not a string (unlike $data which
is typecast), so we might as well as throw an exception so that
at least we have a stack trace.

Bug: T126316
Change-Id: Iad9a499b51647c7dbcd58e9ab7ac8e8cb6359bba
---

diff --git a/includes/utils/MWCryptHash.php b/includes/utils/MWCryptHash.php
index 72c620eec0..11173573e7 100644
--- a/includes/utils/MWCryptHash.php
+++ b/includes/utils/MWCryptHash.php
@@ -105,6 +105,10 @@ class MWCryptHash {
 	 * @return string An hmac hash of the data + key
 	 */
 	public static function hmac( $data, $key, $raw = true ) {
+		if ( !is_string( $key ) ) {
+			// a fatal error in HHVM; an exception will at least give us a stack trace
+			throw new InvalidArgumentException( 'Invalid key type: ' . gettype( $key ) );
+		}
 		return hash_hmac( self::hashAlgo(), $data, $key, $raw );
 	}