Framework/rr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update 'src/RequestResponse/Request.php'

Browse Source
This commit is contained in:
ahwelp
2018-09-10 23:37:28 +00:00
parent 6c787b73a5
commit 0dada2ebbb
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/RequestResponse/Request.php
+15 -15
View File
@@ -148,12 +148,12 @@ class Request{
switch ($type) { switch ($type) {
case self::PARAM_RAW: case self::PARAM_RAW:
// No cleaning at all. // No cleaning at all.
$param = fix_utf8($param); $param = self::fix_utf8($param);
return $param; return $param;
case self::PARAM_RAW_TRIMMED: case self::PARAM_RAW_TRIMMED:
// No cleaning, but strip leading and trailing whitespace. // No cleaning, but strip leading and trailing whitespace.
$param = fix_utf8($param); $param = self::fix_utf8($param);
return trim($param); return trim($param);
case self::PARAM_INT: case self::PARAM_INT:
@@ -198,12 +198,12 @@ class Request{
case self::PARAM_NOTAGS: case self::PARAM_NOTAGS:
// Strip all tags. // Strip all tags.
$param = fix_utf8($param); $param = self::fix_utf8($param);
return strip_tags($param); return strip_tags($param);
case self::PARAM_TEXT: case self::PARAM_TEXT:
// Leave only tags needed for multilang. // Leave only tags needed for multilang.
$param = fix_utf8($param); $param = self::fix_utf8($param);
// If the multilang syntax is not correct we strip all tags because it would break xhtml strict which is required // If the multilang syntax is not correct we strip all tags because it would break xhtml strict which is required
// for accessibility standards please note this cleaning does not strip unbalanced '>' for BC compatibility reasons. // for accessibility standards please note this cleaning does not strip unbalanced '>' for BC compatibility reasons.
do { do {
@@ -293,7 +293,7 @@ class Request{
case self::PARAM_FILE: case self::PARAM_FILE:
// Strip all suspicious characters from filename. // Strip all suspicious characters from filename.
$param = fix_utf8($param); $param = self::fix_utf8($param);
$param = preg_replace('~[[:cntrl:]]|[&<>"`\|\':\\\\/]~u', '', $param); $param = preg_replace('~[[:cntrl:]]|[&<>"`\|\':\\\\/]~u', '', $param);
if ($param === '.' || $param === '..') { if ($param === '.' || $param === '..') {
$param = ''; $param = '';
@@ -302,7 +302,7 @@ class Request{
case self::PARAM_PATH: case self::PARAM_PATH:
// Strip all suspicious characters from file path. // Strip all suspicious characters from file path.
$param = fix_utf8($param); $param = self::fix_utf8($param);
$param = str_replace('\\', '/', $param); $param = str_replace('\\', '/', $param);
// Explode the path and clean each element using the PARAM_FILE rules. // Explode the path and clean each element using the PARAM_FILE rules.
@@ -347,7 +347,7 @@ class Request{
return $param; return $param;
case self::PARAM_URL: // Allow safe ftp, http, mailto urls. case self::PARAM_URL: // Allow safe ftp, http, mailto urls.
$param = fix_utf8($param); $param = self::fix_utf8($param);
if (!empty($param) && self::validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) { if (!empty($param) && self::validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) {
// All is ok, param is respected. // All is ok, param is respected.
} else { } else {
@@ -406,7 +406,7 @@ class Request{
} }
case self::PARAM_TAGLIST: case self::PARAM_TAGLIST:
$param = fix_utf8($param); $param = self::fix_utf8($param);
$tags = explode(',', $param); $tags = explode(',', $param);
$result = array(); $result = array();
foreach ($tags as $tag) { foreach ($tags as $tag) {
@@ -422,7 +422,7 @@ class Request{
} }
case self::PARAM_USERNAME: case self::PARAM_USERNAME:
$param = fix_utf8($param); $param = self::fix_utf8($param);
$param = trim($param); $param = trim($param);
// Convert uppercase to lowercase MDL-16919. // Convert uppercase to lowercase MDL-16919.
$param = core_text::strtolower($param); $param = core_text::strtolower($param);
@@ -435,7 +435,7 @@ class Request{
return $param; return $param;
case self::PARAM_EMAIL: case self::PARAM_EMAIL:
$param = fix_utf8($param); $param = self::fix_utf8($param);
if (validate_email($param)) { if (validate_email($param)) {
return $param; return $param;
} else { } else {
@@ -451,7 +451,7 @@ class Request{
case self::PARAM_TIMEZONE: case self::PARAM_TIMEZONE:
// Can be int, float(with .5 or .0) or string seperated by '/' and can have '-_'. // Can be int, float(with .5 or .0) or string seperated by '/' and can have '-_'.
$param = fix_utf8($param); $param = self::fix_utf8($param);
$timezonepattern = '/^(([+-]?(0?[0-9](\.[5|0])?|1[0-3](\.0)?|1[0-2]\.5))|(99)|[[:alnum:]]+(\/?[[:alpha:]_-])+)$/'; $timezonepattern = '/^(([+-]?(0?[0-9](\.[5|0])?|1[0-3](\.0)?|1[0-2]\.5))|(99)|[[:alnum:]]+(\/?[[:alpha:]_-])+)$/';
if (preg_match($timezonepattern, $param)) { if (preg_match($timezonepattern, $param)) {
return $param; return $param;
@@ -465,7 +465,7 @@ class Request{
} }
} }
function fix_utf8($value) { private static function fix_utf8($value) {
if (is_null($value) or $value === '') { if (is_null($value) or $value === '') {
return $value; return $value;
@@ -477,7 +477,7 @@ class Request{
// No null bytes expected in our data, so let's remove it. // No null bytes expected in our data, so let's remove it.
$value = str_replace("\0", '', $value); $value = str_replace("\0", '', $value);
// Note: this duplicates min_fix_utf8() intentionally. // Note: this duplicates min_self::self::fix_utf8() intentionally.
static $buggyiconv = null; static $buggyiconv = null;
if ($buggyiconv === null) { if ($buggyiconv === null) {
$buggyiconv = (!function_exists('iconv') or @iconv('UTF-8', 'UTF-8//IGNORE', '100'.chr(130).'€') !== '100€'); $buggyiconv = (!function_exists('iconv') or @iconv('UTF-8', 'UTF-8//IGNORE', '100'.chr(130).'€') !== '100€');
@@ -503,7 +503,7 @@ class Request{
} else if (is_array($value)) { } else if (is_array($value)) {
foreach ($value as $k => $v) { foreach ($value as $k => $v) {
$value[$k] = fix_utf8($v); $value[$k] = self::fix_utf8($v);
} }
return $value; return $value;
@@ -511,7 +511,7 @@ class Request{
// Do not modify original. // Do not modify original.
$value = clone($value); $value = clone($value);
foreach ($value as $k => $v) { foreach ($value as $k => $v) {
$value->$k = fix_utf8($v); $value->$k = self::fix_utf8($v);
} }
return $value; return $value;