fix: refresh REQUEST after URI GET normalization

[rahul05ranjan]

Description

Fixes #9872. SiteURIFactory can normalize $_GET after PHP has populated $_REQUEST, leaving stale query values for getVar() and Validation::withRequest(). This follows the direction agreed on in #10587: refresh REQUEST once during URI parsing while keeping getVar()'s existing lookup behavior.

Summary

SiteURIFactory parses the normalized query
  → update GET
  → refresh only REQUEST keys derived from GET, POST, or COOKIE
  → retain unrelated or independently changed REQUEST values

Superglobals::getRequestData() provides the merged source data in PHP's configured order. Both URI parsing paths use it before and after GET normalization. No general synchronization is added to setGetArray().

Evidence

• Before: The two new SiteURI regressions fail on develop: the old query key remains in REQUEST, and code stays stale.
  After: SiteURIFactoryDetectRoutePathTest.php passes (34 tests, 42 assertions), including a withRequest() validation check and preservation of application-set values.
• SuperglobalsTest.php passes (56 tests, 115 assertions); SiteURIFactoryTest.php passes (8 tests, 32 assertions).
• File-scoped PHPStan and PHP CS Fixer checks pass on the changed PHP files. Full CI remains with GitHub Actions.

Merge Danger

Door: Two-way. Reverting the commit restores the previous request initialization behavior.

Blast Radius: Request initialization in the two SiteURIFactory URI parsing paths. An application-defined REQUEST value that is identical to its old merged source value cannot be distinguished from that source value; the refresh treats it as source-derived.

Checklist:

• Securely signed commit (verified by GitHub)
• Component PHPDoc added where it explains the merge and refresh behavior
• Unit testing with >80% coverage (focused tests pass; coverage not measured locally)
• User guide changelog updated; the existing getVar() reference remains accurate
• Conforms to style guide (file-scoped PHP CS Fixer passes)

[rahul05ranjan]

@paulbalandan The new PR's workflows are waiting for approval to run. Could you approve them when you get to this review? Here's the PHPUnit run; the focused local results are in the PR description.

[michalsn]

Overall, I think this looks good.

[Copilot]

🟡 Changes recommended

The new tests depend on the host’s request_order, and SiteURIFactory’s PHPDoc omits its new $_REQUEST side effect.

3 open findings

• Avoid assuming GET is enabled in the request-order regression fixture · New
• Make request-order test deterministic by passing GP explicitly · New
• Update PHPDoc to document $_REQUEST mutations · New

What changed in this PR

Fixes stale $_REQUEST values after URI query normalization while preserving custom entries.

Changes:

• Adds configured GET/POST/COOKIE merging.
• Refreshes source-derived REQUEST entries during URI parsing.
• Adds regression tests and changelog documentation.

Base branch was unavailable; develop compatibility policy was applied. A focused PHP runtime probe passed; full validation remains with CI.

File	Description
system/​Superglobals.php	Adds merged request-data retrieval.
system/​HTTP/​SiteURIFactory.php	Refreshes REQUEST after GET normalization.
tests/​system/​SuperglobalsTest.php	Tests request merging semantics.
tests/​system/​HTTP/​SiteURIFactoryDetectRoutePathTest.php	Tests URI normalization regressions.
user_guide_src/​source/​changelogs/​v4.7.5.rst	Documents the fix.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rahul05ranjan]

Rebased on the latest develop to drop the merge commit — that should sort out the no-merge-commits check.

The PHP 8.5 - SQLite3 failure in the previous run looks like a runner flake: the job log shows a transient autoload failure right before it, and there's no unterminated comment near system/CodeIgniter.php:568 on the head. The fresh CI run should settle it either way.

[rahul05ranjan]

The rebase dropped the commit signature, so the signed-commits check was failing on the rewritten commit. I've restored the original signed commit (7ff3dff) as the branch head — history is linear and signed again.

[paulbalandan]

@rahul05ranjan have you done the review comments? if yes, please comment on them. I can't see "Outdated" so I'm not sure if those were done.

[rahul05ranjan]

Hi @paulbalandan, sorry for the slow response on this.

To confirm the status: the "mark as internal" comment was addressed earlier in 5d28859, and the three remaining review comments are now addressed in c247f6e:

• SuperglobalsTest: getRequestData() now receives an explicit order (GP/G) so the tests no longer depend on the host's request_order.
• SiteURIFactoryDetectRoutePathTest: the REQUEST-refresh fixtures now skip when GET is not part of the effective request order, instead of assuming it.
• SiteURIFactory: the class-level PHPDoc and the docblocks of createFromGlobals(), parseRequestURI(), and parseQueryString() now document the $_REQUEST mutations too.

I've also replied on each of the three threads. Happy to adjust anything further.

[paulbalandan]

Please rebase this against latest develop, and a few finishing touches.

[rahul05ranjan]

@paulbalandan @michalsn All review comments and suggestions have been addressed, the branch is rebased onto the latest develop with a verified signed commit, and all Carson checks are passing. Whenever you get a moment, this is ready for final review and merge. Thanks!