Changeset 958

Timestamp:

Sep 23, 2023, 12:04:04 AM (7 months ago)

Author:

chronos

Message:

• Fixed: Numeric check for input values.

Location:

trunk

Files:

• Application/Version.php (modified) (1 diff)
• Modules/Contract/Contract.php (modified) (1 diff)
• Modules/File/File.php (modified) (1 diff)
• Modules/IS/IS.php (modified) (1 diff)
• Modules/Log/Log.php (modified) (1 diff)
• Modules/News/NewsPage.php (modified) (3 diffs)
• Modules/Notify/Notify.php (modified) (1 diff)
• Packages/Common/Common.php (modified) (1 diff)

trunk/Application/Version.php

@@ -1 +1 @@
 <?php
 
-$Revision = 957; // Subversion revision
+$Revision = 958; // Subversion revision
 $DatabaseRevision = 957; // SQL structure revision
 $ReleaseTime = strtotime('2023-09-22');

trunk/Modules/Contract/Contract.php

@@ -109 +109 @@
   function Show(): string
   {
-    if (array_key_exists('i', $_GET))
+    if (array_key_exists('i', $_GET) and is_numeric($_GET['i']))
     {
       $Output = $this->GenerateContract(' AND (Id='.($_GET['i'] * 1).')');

trunk/Modules/File/File.php

@@ -126 +126 @@
       return '';
     }
-    else if (array_key_exists('i', $_GET))
+    else if (array_key_exists('i', $_GET) and is_numeric($_GET['i']))
     {
       $Id = $_GET['i'] * 1;

trunk/Modules/IS/IS.php

@@ -42 +42 @@
     if (array_key_exists('menutype', $_COOKIE)) $MenuType = $_COOKIE['menutype'];
       else $MenuType = 0;
-    if (array_key_exists('menutype', $_GET)) $MenuType = $_GET['menutype'] * 1;
+    if (array_key_exists('menutype', $_GET) and is_numeric($_GET['menutype'])) $MenuType = $_GET['menutype'] * 1;
     setcookie('menutype', $MenuType, time() + 60 * 60 * 24 * 365);
 

trunk/Modules/Log/Log.php

@@ -61 +61 @@
 
     $Items = array();
-    if (array_key_exists('type', $_GET)) $Where = ' WHERE `Type` = "'.($_GET['type'] * 1).'"';
+    if (array_key_exists('type', $_GET) and is_numeric($_GET['type'])) $Where = ' WHERE `Type` = "'.($_GET['type'] * 1).'"';
       else $Where = '';
     $sql = 'SELECT *, UNIX_TIMESTAMP(`Time`) AS `TimeCreate`, (SELECT `User`.`Name` FROM `User` WHERE `User`.`Id` = `Log`.`User`) AS `UserName`, `Time` FROM `Log`'.

trunk/Modules/News/NewsPage.php

@@ -24 +24 @@
     {
       $Category = $this->GetCategory();
-      if (array_key_exists('id', $_GET) and is_integer($_GET['id'])) $Id = $_GET['id'] * 1;
+      if (array_key_exists('id', $_GET) and is_numeric($_GET['id'])) $Id = $_GET['id'] * 1;
         else return $Output .= 'Položka nenalezena.';
       $DbResult = $this->Database->query('SELECT `News`.*, `User`.`Name` FROM `News` '.
@@ -296 +296 @@
   {
     $Category = array('Id' => 1); // Default category
-    if (array_key_exists('category', $_GET) and is_integer($_GET['category'])) $Category['Id'] = $_GET['category'] * 1;
-    if (array_key_exists('category', $_POST) and is_integer($_POST['category'])) $Category['Id'] = $_POST['category'] * 1;
+    if (array_key_exists('category', $_GET) and is_numeric($_GET['category'])) $Category['Id'] = $_GET['category'] * 1;
+    if (array_key_exists('category', $_POST) and is_numeric($_POST['category'])) $Category['Id'] = $_POST['category'] * 1;
     //if (is_null($Category)) throw new Exception('Kategorie neurčena');
     else
@@ -412 +412 @@
       foreach ($Parts as $Part)
       {
-        if (is_integer($Part)) $Where .= 'OR (`Category`='.($Part * 1).')';
+        if (is_numeric($Part)) $Where .= 'OR (`Category`='.($Part * 1).')';
       }
       $Where = substr($Where, 2);

trunk/Modules/Notify/Notify.php

@@ -204 +204 @@
     td { padding: 5px; }
     </style>';
-    if (!array_key_exists('i', $_GET)) return 'Položka nenalezena';    
+    if (!array_key_exists('i', $_GET) or !is_numeric($_GET['i'])) return 'Položka nenalezena';    
     $Id = $_GET['i'] * 1;
     $DbResult = $this->Database->select('NotifyLog', 'Title,Content, UNIX_TIMESTAMP(`Time`) AS `Time`', 'Id='.$Id);

trunk/Packages/Common/Common.php

@@ -84 +84 @@
 
     if (!array_key_exists('Page', $_SESSION)) $_SESSION['Page'] = 0;
-    if (array_key_exists('page', $_GET)) $_SESSION['Page'] = $_GET['page'] * 1;
+    if (array_key_exists('page', $_GET) and is_numeric($_GET['page'])) $_SESSION['Page'] = $_GET['page'] * 1;
     if ($_SESSION['Page'] < 0) $_SESSION['Page'] = 0;
     if ($_SESSION['Page'] >= $PageCount) $_SESSION['Page'] = $PageCount - 1;