Yii::$app->request->get() not returning + sign from URL parameter

Yii 2.0
1

I have a major issue. I doubt it’s a Yii bug, but I’m not clear what I am doing wrong as I’m just using Yii::$app->request->get().

Okay, so our app will receive a URL signature when data is passed to us, e.g., /some-path?data1=a&data2=b&data3=c&signature=09Tnou51h0Abf++ApP3E12XHFUQ=

Normally, this works great. We grab the signature, use hmacValidator() on it, all nice and tidy.

EXCEPT if the signature has plus (+) signs in it! I have tested this every way possible, and Yii::$app->request->get() will always return a single space (_) instead of the plus signs.

For example, if the signature on the URL is:
/some-path?data1=a&data2=b&data3=c&signature=09Tnou51h0Abf++ApP3E12XHFUQ=

This is what I get from Yii:

Array::getValue(Yii::$app->request->get(), 'signature') == "09Tnou51h0Abf ApP3E12XHFUQ="

We use nginx, and I have verified via the access.log that we are in fact getting a properly formed URL and signature. However, using request->get() returns the above.

This is a pretty serious issue, so my assumption is that it’s not Yii but me. Otherwise, this would break a lot of things.

What am I missing?

Also, potentially relevant:

$config['components']['urlManager'] = [
    'enablePrettyUrl' => true,
    'showScriptName' => false,
    'rules' => [],
];
2

This is expected, + is translated to spaces while parsing URLs. If you really want to pass + sign, you need to encode it: /some-path?data1=a&data2=b&data3=c&signature=09Tnou51h0Abf%2B%2BApP3E12XHFUQ%3D.

1 Like