When:
- a float is used in a SQL function (e.g. Database::insert()) AND
- wgShellLocale is not en_US.UTF-8 or C.UTF-8 but a locale with a comma as decimal separator (e.g. fr_FR.UTF-8)
Then the value is truncated to its integer part.
To reproduce it:
It happens that page_propos has a column with the type FLOAT, hence I use it for this example.
Use a test wiki for this example, it changes the database in a way MediaWiki could misfunction after.
- Set $wgShellLocale = 'fr_FR.UTF-8'; in LocalSettings.php
- Launch maintenance/eval.php with the commands:
$row = [ 'pp_page' => 1, 'pp_propname' => 'test', 'pp_value' => 'test', 'pp_sortkey' => 0.37 ]; $dbw = wfGetDB( DB_MASTER ); $dbw->insert( 'page_props', $row, __METHOD__ );
- In the database see that the value for pp_sortkey is 0.
- Delete the added line.
- Set $wgShellLocale = 'C.UTF-8'; in LocalSettings.php
- Re-do step 2
- In the database see that the value for pp_sortkey is 0.37.
I wrongly reported it as a PHP bug #69348, but real_escape_string() really wants a string as input parameter, hence a silent conversion float -> string is done with the current locale. An explicit conversion should be done using a fixed locale (C.UTF-8 I guess) or without locale if possible.