[Noalyss-commit] [noalyss] 149/219: HttpInput: protect against injection

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 40b81bb7e63587c459b110e82f672b86fc724d64
Author: Dany De Bontridder <address@hidden>
Date:   Sun Nov 12 11:26:54 2017 +0100

    HttpInput: protect against injection
---
 include/lib/http_input.class.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/lib/http_input.class.php b/include/lib/http_input.class.php
index db04220..f286d8d 100644
--- a/include/lib/http_input.class.php
+++ b/include/lib/http_input.class.php
@@ -48,21 +48,25 @@ class HttpInput
             if ($p_type=="string")
                 return;
             // Check if number
-            if ($p_type=="number"&&isNumber($this->array[$p_name])==0
-            )
+            if ($p_type=="number"&&isNumber($this->array[$p_name])==0          
  )
+            {
+                $this->array[$p_name]=h($this->array[$p_name]);
                 throw new Exception(_("Type invalide")."[ $p_name ] = 
{$this->array[$p_name]}"
                 , EXC_PARAM_TYPE);
+            }
             // Check if date dd.mm.yyyy
             if ($p_type=="date")
             {
                 if (isDate($this->array[$p_name]) <> $this->array[$p_name])
                 {
+                    $this->array[$p_name]=h($this->array[$p_name]);
                     throw new Exception(_("Type invalide")."[ $p_name ] = 
{$this->array[$p_name]}"
                     , EXC_PARAM_TYPE);
                 }
             }
             if ($p_type=="array"&&!is_array($this->array[$p_name]))
             {
+                $this->array[$p_name]=h($this->array[$p_name]);
                 throw new Exception(_("Type invalide")."[ $p_name ] = 
{$this->array[$p_name]}"
                 , EXC_PARAM_TYPE);
             }