Comma character in $arrFilterUrl

[richardhj]

Checklist before I submit this issue report

I confirm that:

• I have tested this with the latest version available
• I have read documentation @ http://metamodels.readthedocs.org/en/ or http://metamodels.readthedocs.org/de/
• I have checked the Contao community forums for references https://community.contao.org/
• I have checked existing issues for duplicates and found none @ https://github.com/MetaModels/core/issues?q=is%3Aissue

My environment is:

(Please fill in the actual values from your environment)

Key	Value	Comments
PHP version:	7.3
Contao version:	4.7
MetaModels version:	2.1
Installation via composer:	yes
Installed MetaModels packages:	filter_fromto
DCG version:	2.1

Issue description

A comma in the filter URL will be handled as array delimiter.

Steps to reproduce

1. Place a "fromto" filter on a decimal attribute in the frontend.
2. If the user inputs a "comma", e.g. 20,00 instead of 20.00, the error will be thrown.

Live example:
https://www.ferienpass-luebeck.de/angebote/fee/20.00 OK
https://www.ferienpass-luebeck.de/angebote/fee/20,00 NOT OK

Stack trace: https://sentry.io/share/issue/ac77bf0c81e84605a381b4886d18c136/
where $arrFilterUrl =

{
  age: 8,
  available: 1,
  date: ,,
  fee: 20,00
}

[richardhj]

If you have a look at the live example, a comma character is used as a delimiter character for the "date" filter! It is only malicious for the "fee" filter.

[discordier]

Well, the filter expects a number in English locale where you pass a German locale formatted number here.

As we do not have a locale setting for the decimal separator, I wonder how we can proceed here. 😿

[richardhj]

Can the character , somehow be urlencoded to %2C?

[discordier]

Which would still be wrong, as the decimal attribute wants a decimal value to filter later on.

The issue belongs to the fromto filter (and maybe also the range filter) anyway.

In there, only the decimal filtering is causing issues, as they do not handle anything aside from dates, numbers and decimals of which only the latter ones are affected.

[discordier]

The decimal attribute casts the value to float and will therefore loose the decimal part ((float)"20,5" => double(20)).

I guess the best immediate solution is to build a kernel.request listener with high priority that swaps the value in the request post data prior redirecting. The URL containing a comma however is plain wrong.

[zonky2]

it´s a bug or feature?