Closed
Description
Symfony version(s) affected: all supported versions (and >=2.1, too)
Description
Given that HTTP method override is active, setting an array as _method
parameter in a random form with POST
method raises a PHP warning.
How to reproduce
Activate HTTP method override
framework:
http_method_override: true
Submit a random form with POST
method to a URL which contains an array as _method
query parameter (e. g. https://example.com?_method[]=foo&_method[]=bar
).
Possible Solution
Request::getMethod()
should check the type of the acquired _method
value and don't use it if it is no string.
Additional context
PHP Warning: strtoupper() expects parameter 1 to be string, array given in var/bootstrap.php.cache on line 977
bootstrap.php.cache line 977 is equivalent to src/Symfony/Component/HttpFoundation/Request.php
$this->method = strtoupper($this->request->get('_method', $this->query->get('_method', 'POST')));