Empty substring match in MAX_limitationsMatchArrayValue

[Kai (DC)]

Maybe I'm misunderstanding this but

function MAX_limitationsMatchArrayValue($value, $limitation, $op)
{
    if ($op == '==') {
        return strcasecmp($limitation, $value) == 0;
    } else if ($op == '=~') {
        if ($value == '') {
            return true;
        }
 

in lib/max/Delivery/limitations.delivery.php means that an empty string matches any substring match which seems wrong to me.

Because "" does not really substring match "a,b,c" now does it? Or am I missing the forest for the trees?

[andrewatfornax]

That does seem odd from a superficial point of view looking at the code in isolation, but what delivery rules use that code, and in what real-world setup examples is it causing an issue?

Code in isolation is one thing, but the context is important!

[Kai (DC)]

Thanks for your reply. ?

We wrote a plugin that allows to match banners by our users' professions. This uses a "contains" ("=~") match (so it's looking for profession 1 in the list "1,2,3,4").

In some rare (and hard to reproduce) cases  a user would get banners for the wrong profession during a longer session. I tracked this down to profession info dropping from the session (that issue is on our end and I hopefully fixed that) in which case an empty string would be fed into the match. And since that returns true always (as per code above), suddenly banners with totally different profession groups were matching.

We don't have the issue for users who aren't logged in because in that case the plugin doesn't even try to match, but empty data for logged-in users cause the issue.

(I didn't file this as bug report because the issue can be fixed on our end but I wanted to understand why the code above does what it does.)

Edited April 21, 2020 by Kai (DC)
Forgot a paragraph