composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-13 07:24:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

N°2957 - Better check of the class parameter in requests

Browse Source
This commit is contained in:
Eric
2020-07-10 14:41:38 +02:00
parent 78516f437a
commit b1fa429234
4 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
application/utils.inc.php
View File

@@ -283,6 +283,8 @@ class utils
*
* @since 2.5.2 2.6.0 new 'transaction_id' filter
* @since 2.7.0 new 'element_identifier' filter
*
* @throws \CoreException
*/
protected static function Sanitize_Internal($value, $sSanitizationFilter)
{
@@ -296,7 +298,7 @@ class utils
$retValue = $value;
if (!MetaModel::IsValidClass($value))
{
$retValue = false;
throw new CoreException(Dict::Format('UI:OQL:UnknownClassNoFix', utils::HtmlEntities($value)));
}
break;

2
datamodels/2.x/itop-attachments/ajax.itop-attachment.php
View File

@@ -32,7 +32,7 @@ require_once(APPROOT.'/application/ajaxwebpage.class.inc.php');
*/
function RenderAttachments(ajax_page $oPage, $iTransactionId)
{
$sClass = utils::ReadParam('objclass', '');
$sClass = utils::ReadParam('objclass', '', false, 'class');
$sId = utils::ReadParam('objkey', '');
$oObject = MetaModel::GetObject($sClass, $sId, false);
$bEditMode = utils::ReadParam('edit_mode', 0);

12
pages/UI.php
View File

@@ -388,7 +388,7 @@ try
///////////////////////////////////////////////////////////////////////////////////////////
case 'details': // Details of an object
$sClass = utils::ReadParam('class', '');
$sClass = utils::ReadParam('class', '', false, 'class');
$id = utils::ReadParam('id', '');
if ( empty($sClass) || empty($id))
{
@@ -459,7 +459,7 @@ try
case 'release_lock_and_details':
$oP->DisableBreadCrumb();
$sClass = utils::ReadParam('class', '');
$sClass = utils::ReadParam('class', '', false, 'class');
$id = utils::ReadParam('id', '');
$oObj = MetaModel::GetObject($sClass, $id);
$sToken = utils::ReadParam('token', '');
@@ -906,7 +906,7 @@ HTML
case 'apply_modify': // Applying the modifications to an existing object
$oP->DisableBreadCrumb();
$sClass = utils::ReadPostedParam('class', '');
$sClass = utils::ReadPostedParam('class', '', 'class');
$sClassLabel = MetaModel::GetName($sClass);
$id = utils::ReadPostedParam('id', '');
$sTransactionId = utils::ReadPostedParam('transaction_id', '', 'transaction_id');
@@ -1493,7 +1493,7 @@ HTML
}
$iFieldsCount = count($aFieldsMap);
$sJsonFieldsMap = json_encode($aFieldsMap);
$oP->add_script(
<<<EOF
// Initializes the object once at the beginning of the page...
@@ -1695,7 +1695,7 @@ EOF
case 'apply_stimulus': // Actual state change
$oP->DisableBreadCrumb();
$sClass = utils::ReadPostedParam('class', '');
$sClass = utils::ReadPostedParam('class', '', 'class');
$id = utils::ReadPostedParam('id', '');
$sTransactionId = utils::ReadPostedParam('transaction_id', '', 'transaction_id');
$sStimulus = utils::ReadPostedParam('stimulus', '');
@@ -1938,7 +1938,7 @@ EOF
case 'kill_lock':
$oP->DisableBreadCrumb();
$sClass = utils::ReadParam('class', '');
$sClass = utils::ReadParam('class', '', false, 'class');
$id = utils::ReadParam('id', '');
iTopOwnershipLock::KillLock($sClass, $id);
$oObj = MetaModel::GetObject($sClass, $id);

2
pages/navigator.php
View File

@@ -36,7 +36,7 @@ $oAppContext = new ApplicationContext();
$oP = new iTopWebPage("iTop - Navigator");
// Main program
$sClass = utils::ReadParam('class', '');
$sClass = utils::ReadParam('class', '', false, 'class');
$id = utils::ReadParam('id', 0);
$sRelation = utils::ReadParam('relation', 'neighbours');