-
Bug
-
Resolution: Fixed
-
Major
-
3.2.10, 3.3.4
-
None
-
None
The S_FORUM_ID and S_TOPIC_ID variables in the page_header function are passed as-is from the user request with only an integer conversion. Integers can be negative, but forum and topic IDs cannot.
When a request to a valid page with an invalid forum or topic ID in the URL is made, e.g. <https://area51.phpbb.com/phpBB/viewtopic.php?f=-9001&p=348626> or <https://area51.phpbb.com/phpBB/viewtopic.php?t=-9001&p=348626>, and forum feeds are enabled, a negative ID will be passed to the path Twig helper function (phpbb\template\twig\extension\routing::getPath) which will end up being validated by the regular expression /\d+/ (from config/default/routing/feed.yml) and fail, which triggers an uncaught Symfony\Component\Routing\Exception\InvalidParameterException.