From 10fcc2b6130597966b057dc3b15b972db961fc08 Mon Sep 17 00:00:00 2001 From: Bogdan Date: Mon, 21 Sep 2026 23:21:56 +0200 Subject: [PATCH 1/3] fix: reject non-digit characters in valid_cc_number() Use ctype_digit() instead of is_numeric() so values such as decimal points, which is_numeric() accepts, can no longer reach the Luhn check. Previously a string like '5351367.37861108' passed validation and the Luhn indexer triggered an 'Undefined array key' warning on non-digit characters. --- system/Validation/CreditCardRules.php | 2 +- .../Validation/StrictRules/CreditCardRulesTest.php | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/system/Validation/CreditCardRules.php b/system/Validation/CreditCardRules.php index a31b303fcb86..73eb36296974 100644 --- a/system/Validation/CreditCardRules.php +++ b/system/Validation/CreditCardRules.php @@ -200,7 +200,7 @@ public function valid_cc_number(?string $ccNumber, string $type): bool $ccNumber = str_replace([' ', '-'], '', $ccNumber); // Non-numeric values cannot be a number...duh - if (! is_numeric($ccNumber)) { + if (! ctype_digit($ccNumber)) { return false; } diff --git a/tests/system/Validation/StrictRules/CreditCardRulesTest.php b/tests/system/Validation/StrictRules/CreditCardRulesTest.php index deda7d76f984..55a880839662 100644 --- a/tests/system/Validation/StrictRules/CreditCardRulesTest.php +++ b/tests/system/Validation/StrictRules/CreditCardRulesTest.php @@ -100,6 +100,16 @@ public static function provideValidCCNumber(): iterable 'abcd efgh ijkl mnop', false, ], + 'decimal_point_visa' => [ + 'visa', + '41.1111111111111', + false, + ], + 'decimal_point_mastercard' => [ + 'mastercard', + '5351367.37861108', + false, + ], 'bad_length' => [ 'amex', '3782 8224 6310 0051', From 10a5a036702a29e3247ab861264ceb37a5e86061 Mon Sep 17 00:00:00 2001 From: Bogdan Date: Mon, 21 Sep 2026 23:28:53 +0200 Subject: [PATCH 2/3] docs: add Validation changelog entry for valid_cc_number fix --- user_guide_src/source/changelogs/v4.7.5.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/user_guide_src/source/changelogs/v4.7.5.rst b/user_guide_src/source/changelogs/v4.7.5.rst index 5fc0cfce5578..8da98205bf39 100644 --- a/user_guide_src/source/changelogs/v4.7.5.rst +++ b/user_guide_src/source/changelogs/v4.7.5.rst @@ -59,6 +59,7 @@ Bugs Fixed - **Honeypot:** Fixed a bug where bot detection returned an HTTP 500 response instead of 403 (Forbidden). - **I18n:** Fixed a bug where ``Time::today()``, ``Time::yesterday()``, and ``Time::tomorrow()`` ignored the specified ``$timezone`` and ``setTestNow()`` when calculating the day. - **Logger:** Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors. +- **Validation:** Fixed a bug where ``valid_cc_number`` accepted non-digit characters (e.g., a decimal point) in the card number. Such values could pass the Luhn check and triggered an ``Undefined array key`` warning inside it; the number is now checked with ``ctype_digit()``. See the repo's `CHANGELOG.md `_ From aba211ff01904988e0645ced6c55bd10340ed52b Mon Sep 17 00:00:00 2001 From: Bogdan Date: Tue, 22 Sep 2026 21:13:44 +0200 Subject: [PATCH 3/3] refactor: remove unnecessary comment from CreditCardRules --- system/Validation/CreditCardRules.php | 1 - 1 file changed, 1 deletion(-) diff --git a/system/Validation/CreditCardRules.php b/system/Validation/CreditCardRules.php index 73eb36296974..0bc20f082123 100644 --- a/system/Validation/CreditCardRules.php +++ b/system/Validation/CreditCardRules.php @@ -199,7 +199,6 @@ public function valid_cc_number(?string $ccNumber, string $type): bool // Remove any spaces and dashes $ccNumber = str_replace([' ', '-'], '', $ccNumber); - // Non-numeric values cannot be a number...duh if (! ctype_digit($ccNumber)) { return false; }