From 9b2a313953c777aeeb5a19a543b7d10fc9502da9 Mon Sep 17 00:00:00 2001 From: vince Date: Sun, 12 Dec 2021 00:12:28 +0100 Subject: [PATCH] =?UTF-8?q?v=C3=A9rifie=20un=20peu=20mieux=20les=20entr?= =?UTF-8?q?=C3=A9es?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- index.php | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/index.php b/index.php index 2cf9d8b..7cf5a5c 100644 --- a/index.php +++ b/index.php @@ -8,9 +8,9 @@ define('DATA_FILE', __DIR__ . DIRECTORY_SEPARATOR . 'data.php'); if (file_exists(CONFIG_FILE)) require_once CONFIG_FILE; if (!isset($config)) $config = []; -$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : null; +$action = (isset($_REQUEST['action']) and preg_match('/^[a-z]{1,16}$/i', $_REQUEST['action'])) ? $_REQUEST['action'] : null; -$hasSupplier = isset($_REQUEST['supplier']) and !empty($_REQUEST['supplier']); +$hasSupplier = isset($_REQUEST['supplier']) and !empty($_REQUEST['supplier']) and preg_match('/^[A-Za-z]\w{0,31}$/', $_REQUEST['supplier']); $supplier = $_REQUEST['supplier']; if ($hasSupplier) { @@ -52,7 +52,7 @@ if ($hasSupplier) { foreach (array_keys($config[$supplier]) as $key) if (isset($_REQUEST[$key])) - $config[$supplier][$key] = $_REQUEST[$key]; + $config[$supplier][$key] = (!in_array($key, ['title', 'description']) ? filter_var($_REQUEST[$key], FILTER_SANITIZE_STRING) : $_REQUEST[$key]); } if (empty($config[$supplier]['start'])) @@ -93,7 +93,15 @@ if ($action === 'config') { $isConfig = true; } -$hasEvent = isset($_REQUEST['event']); +try { + $hasEvent = ( + isset($_REQUEST['event']) + and preg_match('/^\d{4}\-[01]\d\-[0123]\d$/', $_REQUEST['event']) + and ((new \DateTimeImmutable($_REQUEST['event'])) instanceof \DateTimeImmutable) + ); +} catch (\Exception $exception) { + $hasEvent = false; +} if (!$isConfig and $hasSupplier) { $start = new \DateTime($config[$supplier]['start']); if (!$hasEvent) { @@ -133,7 +141,7 @@ if (!$isConfig and $hasSupplier) { fwrite($output, '