Skip to content

fix: sync $_REQUEST after modifying $_GET in SiteURIFactory#10205

Open
jalexiscv wants to merge 1 commit into
codeigniter4:developfrom
jalexiscv:fix/bug-9872-getvar-request-sync
Open

fix: sync $_REQUEST after modifying $_GET in SiteURIFactory#10205
jalexiscv wants to merge 1 commit into
codeigniter4:developfrom
jalexiscv:fix/bug-9872-getvar-request-sync

Conversation

@jalexiscv
Copy link
Copy Markdown

Description

Fixes #9872 - getVar() behaves inconsistently with GET parameters

Problem

When SiteURIFactory modifies $_GET via setGetArray() during request URI parsing, it does not update $_REQUEST. Since IncomingRequest::getVar() reads from $_REQUEST, validation methods like $validator->withRequest() receive stale data.

Solution

  1. Add Superglobals::syncRequest() method that rebuilds $_REQUEST from $_GET, $_POST, and $_COOKIE respecting PHP request_order
  2. Call syncRequest() in SiteURIFactory after each setGetArray() call

Changes

  • system/Superglobals.php: Add syncRequest() method
  • system/HTTP/SiteURIFactory.php: Call syncRequest() after setGetArray()

Testing

  • All existing tests pass (no regressions)
  • Manual verification confirms $_REQUEST syncs correctly

Ref: #9872
Closes #9872

@mergeable
Copy link
Copy Markdown

mergeable Bot commented May 18, 2026

Hi there, jalexiscv! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

Sincerely, the mergeable bot 🤖

Fixes codeigniter4#9872

When SiteURIFactory modifies $_GET via setGetArray(), it does not
update $_REQUEST. Since IncomingRequest::getVar() reads from $_REQUEST
(via fetchGlobal('request')), validation with $validator->withRequest()
receives stale data.

Changes:
- Add Superglobals::syncRequest() method that rebuilds $_REQUEST from
  $_GET, $_POST, and $_COOKIE respecting PHP's request_order
- Call syncRequest() in SiteURIFactory after each setGetArray() call

Ref: codeigniter4#9872
@jalexiscv jalexiscv force-pushed the fix/bug-9872-getvar-request-sync branch from 9045b60 to 2dddec6 Compare May 18, 2026 03:06
Copy link
Copy Markdown
Contributor

@neznaika0 neznaika0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has already been discussed. The $_request does not change after the request. The right solution would be to abandon getVar() as deprecated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: getVar() behaves inconsistently with GET parameters

2 participants