[php-src] Issue #13016: Assigning variable value in IF statement can cause critical security issues due to typo
| From: | pak0s | Date: | Sat, 23 Dec 2023 23:56:28 +0000 |
| Subject: | [php-src] Issue #13016: Assigning variable value in IF statement can cause critical security issues due to typo | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-246118@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/13016
Author: pak0s
### Description
First of all I do not see any reason why to assign a variable inside IF statement when the condition
will always be true unless the assigned value is 0 or boolean false. I am saying this because a
client had a huge security breach due to this error. Following is the sample vulnerable code:
```php
<?php
$currentadmin = 'notadmin';
if($currentadmin = 'admin'){
//do admin things
}
?>
```
This was a typo error by developer which caused a huge security issue. I believe use of single
= in IF statement should trigger syntax error.
### PHP Version
PHP 8.3.1
### Operating System
_No response_