Legacy API logs every unknown path as an Error event and warns on a bare /api/

Sheernox

Sheernox

New Member
Env: ClientExec 7.2.2 (ionCube), PHP 8.5.10, MariaDB 11.8.9. api/index.php and the htaccess file in api/ match the release zip.

Where: api/index.php lines 38-78 (encoded); the stock htaccess file in api/ rewrites every path under /api/ that is not a file to it.

Bug: Bots probing /api/ fill Admin > Event List with Error events, and a request for /api/ itself writes PHP warnings to the error log.
  • An unknown path is logged as No default module defined for this application followed by the HTTP method and path in brackets, query string included: GET /api/config.js?v=1 logs getconfig.js?v=1, POST /api/reset_password logs addreset_password. One scanner run logged 13 in two minutes.
  • GET /api/ with no path logs get and, on PHP 8.5, writes the errors below.

Repro: Signed out, open /api/ and /api/config.js?v=1 on the ClientExec host (a browser is enough), then open Admin > Event List and the PHP error log.

Error: PHP log entries for api/index.php (function names quoted without their brackets):
  • Line 38: Warning "Undefined array key 1"
  • Line 38: Deprecated "Using null as the key parameter for array_key_exists is deprecated, use an empty string instead"
  • Line 43: Warning "Undefined array key 1"
  • Line 55: Warning "Undefined array key 1"
  • Line 78: Deprecated "strtolower: Passing null to parameter #1 of type string is deprecated"

Expected: A 404 with no Error event for a path that names no API module, and the missing path segment checked before it is read.
 
You must log in or register to reply here.
Back
Top