From 40b81bb7e63587c459b110e82f672b86fc724d64 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Sun, 12 Nov 2017 11:26:54 +0100
Subject: [PATCH] HttpInput: protect against injection

---
 include/lib/http_input.class.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/lib/http_input.class.php b/include/lib/http_input.class.php
index db04220aa..f286d8d6e 100644
--- a/include/lib/http_input.class.php
+++ b/include/lib/http_input.class.php
@@ -48,21 +48,25 @@ class HttpInput
             if ($p_type=="string")
                 return;
             // Check if number
-            if ($p_type=="number"&&isNumber($this->array[$p_name])==0
-            )
+            if ($p_type=="number"&&isNumber($this->array[$p_name])==0            )
+            {
+                $this->array[$p_name]=h($this->array[$p_name]);
                 throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
                 , EXC_PARAM_TYPE);
+            }
             // Check if date dd.mm.yyyy
             if ($p_type=="date")
             {
                 if (isDate($this->array[$p_name]) <> $this->array[$p_name])
                 {
+                    $this->array[$p_name]=h($this->array[$p_name]);
                     throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
                     , EXC_PARAM_TYPE);
                 }
             }
             if ($p_type=="array"&&!is_array($this->array[$p_name]))
             {
+                $this->array[$p_name]=h($this->array[$p_name]);
                 throw new Exception(_("Type invalide")."[ $p_name ] = {$this->array[$p_name]}"
                 , EXC_PARAM_TYPE);
             }