admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

HttpInput: protect against injection

Browse source
This commit is contained in:
Dany De Bontridder 2017-11-12 11:26:54 +01:00
parent 4da3a12572
commit 40b81bb7e6
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
include/lib/http_input.class.php
View file

@ -48,21 +48,25 @@ class HttpInput
if ($p_type=="string")
return;
// Check if number
if ($p_type=="number"&&isNumber($this->array[$p_name])==0
)
if ($p_type=="number"&&isNumber($this->array[$p_name])==0 )
{
$this->array[$p_name]=h($this->array[$p_name]);
throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
, EXC_PARAM_TYPE);
}
// Check if date dd.mm.yyyy
if ($p_type=="date")
{
if (isDate($this->array[$p_name]) <> $this->array[$p_name])
{
$this->array[$p_name]=h($this->array[$p_name]);
throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
, EXC_PARAM_TYPE);
}
}
if ($p_type=="array"&&!is_array($this->array[$p_name]))
{
$this->array[$p_name]=h($this->array[$p_name]);
throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
, EXC_PARAM_TYPE);
}