php8: "string + string" fatal in index_wr.php

    echo "Get User Error:" + $argz[0];

A concatenation written in javascript style, with "+" instead of the php ".".
On php 5 and 7 it evaluated to 0+0 with a warning and printed "0"; since
php 8 adding two non numeric strings is a TypeError, and with no catch
anywhere the brisk-spush daemon died on the spot.

The branch is trivial to reach: a request to index_wr.php with an
unrecognised session is enough, an expired cookie for instance. Found by
sending a getchallenge after a daemon restart.

All similar cases were looked for: this is the only one in php code, the
other "+" between strings are inside javascript embedded in the html, or in
shell scripts quoted in comments.

Found by playing a real game in the container: five authenticated users,
table 4, the auction, 40 cards played, score saved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE

diff --git a/web/index_wr.php b/web/index_wr.php
index efa5a79793bf827ffa8e4e7c1389b67e5cbd4901..4d043c746c459667e381cfa14d203a9c6dbebf5d 100644 (file)
--- a/web/index_wr.php
+++ b/web/index_wr.php
@@ -333,7 +333,11 @@ function index_wr_main(&$brisk, $remote_addr_full, $get, $post, $cookie)
         }
         else {
             log_wr("Get User Error");
-            echo "Get User Error:" + $argz[0];
+            /* php8: it used to be "+", a javascript style concatenation. On php5/7
+               it evaluated to 0+0 with a warning; since php 8 "string + string"
+               on non numeric strings is a fatal TypeError, and here it killed
+               the daemon. */
+            echo "Get User Error:" . $argz[0];
             return FALSE;
         }
         return TRUE;