Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

New: Add option 'aZ' into GETPOST function to check parameters

Browse Source 
contains only a to z or A to Z characters.
This commit is contained in:
Laurent Destailleur 2014-01-08 00:10:39 +01:00
parent 9a33d67527
commit 6ff337ccad
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -17,8 +17,8 @@ For developers:
- New: Add path file of trigger into admin trigger list page.
- New: More phpunit tests.
- New: Payments and supplier payment pages tabs can now be extended from modules.
- New: Add option 'az' into GETPOST function to check parameters conatins
only a to z characters.
- New: Add option 'aZ' into GETPOST function to check parameters contains
only a to z or A to Z characters.
***** ChangeLog for 3.5 compared to 3.4.* *****

4
htdocs/core/lib/functions.lib.php
View File

@ -198,12 +198,12 @@ function GETPOST($paramname,$check='',$method=0)
if (preg_match('/"/',$out)) $out='';
else if (preg_match('/\.\.\//',$out)) $out='';
}
elseif ($check == 'az')
elseif ($check == 'aZ')
{
$out=trim($out);
// '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals
if (preg_match('/[^a-z]+/',$out)) $out='';
if (preg_match('/[^a-z]+/i',$out)) $out='';
}
elseif ($check == 'array')
{