Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-09 11:08:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fight against $_POST

Browse Source
This commit is contained in:
Laurent Destailleur
2020-11-30 14:47:07 +01:00
parent fa8b960520
commit 00ad6df395
51 changed files with 199 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
htdocs/core/lib/functions.lib.php
View File

@@ -224,14 +224,14 @@ function dol_shutdown()
}
/**
* Return true if we are in a context of submitting a parameter
* Return true if we are in a context of submitting the parameter $paramname
*
* @param string $paramname Name or parameter to test
* @return boolean True if we have just submit a POST or GET request with the parameter provided (even if param is empty)
*/
function GETPOSTISSET($paramname)
{
$isset = 0;
$isset = false;
$relativepathstring = $_SERVER["PHP_SELF"];
// Clean $relativepathstring
@@ -254,7 +254,7 @@ function GETPOSTISSET($paramname)
{
if ($key == $paramname) // We are on the requested parameter
{
$isset = 1;
$isset = true;
break;
}
}
@@ -263,16 +263,16 @@ function GETPOSTISSET($paramname)
// If there is saved contextpage, page or limit
if ($paramname == 'contextpage' && !empty($_SESSION['lastsearch_contextpage_'.$relativepathstring]))
{
$isset = 1;
$isset = true;
} elseif ($paramname == 'page' && !empty($_SESSION['lastsearch_page_'.$relativepathstring]))
{
$isset = 1;
$isset = true;
} elseif ($paramname == 'limit' && !empty($_SESSION['lastsearch_limit_'.$relativepathstring]))
{
$isset = 1;
$isset = true;
}
} else {
$isset = (isset($_POST[$paramname]) || isset($_GET[$paramname]));
$isset = (isset($_POST[$paramname]) || isset($_GET[$paramname])); // We must keep $_POST and $_GET here
}
return $isset;
@@ -287,13 +287,13 @@ function GETPOSTISSET($paramname)
* @param string $check Type of check
* ''=no check (deprecated)
* 'none'=no check (only for param that should have very rich content)
* 'array', 'array:restricthtml' or 'array:aZ09' to check it's an array
* 'int'=check it's numeric (integer or float)
* 'intcomma'=check it's integer+comma ('1,2,3,4...')
* 'alpha'=Same than alphanohtml since v13
* 'alphanohtml'=check there is no html content and no " and no ../
* 'aZ'=check it's a-z only
* 'aZ09'=check it's simple alpha string (recommended for keys)
* 'array'=check it's array
* 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string)
* 'nohtml'=check there is no html content and no " and no ../
* 'restricthtml'=check html content is restricted to some tags only
@@ -411,7 +411,6 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
}
}
} // Management of default search_filters and sort order
//elseif (preg_match('/list.php$/', $_SERVER["PHP_SELF"]) && ! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
elseif (!empty($paramname) && !isset($_GET[$paramname]) && !isset($_POST[$paramname]))
{
if (!empty($user->default_values)) // $user->default_values defined from menu 'Setup - Default values'
@@ -476,6 +475,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
if ($qualified)
{
// We must keep $_POST and $_GET here
if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all']))
{
// We made a search from quick search menu, do we still use default filter ?