[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Tiki Inputs Filtres: normalize input filtering across multiple pages (no behavior changes)
"Elifeleti Mukisa Dan \(@Danelif\) via TikiWiki-cvs" <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.cvs |
|---|---|
| Message-ID | <691c70065f477_2a128e35c7842b@gitlab-sidekiq-low-urgency-cpu-bound-v2-cf788b4bc-p9nts.mail> |
Elifeleti Mukisa Dan pushed to branch master at Tiki Wiki CMS Groupware / Tiki
Commits:
88a6dade by Doddy MATABARO at 2025-11-18T13:00:42+00:00
[FIX] Tiki Inputs Filtres: normalize input filtering across multiple pages (no behavior changes)
---
* [FIX] Update input validation in tiki-view_forum_thread.php
* [FIX] Update input validation in tiki-view_blog.php and tiki-view_blog_post.php
* [FIX] Update input validation in tiki-view_articles.php: change 'sort_mode' to 'alnumdash', 'offset' to 'int', 'min_rating' and 'max_rating' to 'digits', 'type' to 'striptags', 'topic' to 'int', 'topicName' to 'striptags', and add 'find' as 'striptags' and 'watch_action' as 'alpha'
* [FIX] Update input validation in tiki-usermenu.php: change 'name' to 'striptags', 'mode' to 'alpha', 'sort_mode' to 'alnumdash', 'find' to 'striptags', and 'menu' to 'int'
* [FIX] Update input validation for 'event' to use 'striptags' and 'cat_categories' to use 'int' in tiki-user_watches.php
* [FIX] Update input validation for 'user_contacts_default_view' to use 'alpha' in tiki-user_contacts_prefs.php
* [FIX] Update input validation in tiki-user_tasks.php: change filters to 'bool', 'alpha', and 'alnum' for various request parameters
* [FIX] Update user preferences input validation: change 'xmpp_password' to 'password', 'perspective_preferred' to 'digits', and add new fields for notifications and cookie consent
* [FIX] Tiki Filters: Update input validation for 'ext_add' to use 'striptags' instead of 'string' in tiki_user_contacts_pref.php
* [UPD] deps: update rubix/ml to ~2.5
See merge request tikiwiki/tiki!9049
- - - - -
9 changed files:
- tiki-user_contacts_prefs.php
- tiki-user_preferences.php
- tiki-user_tasks.php
- tiki-user_watches.php
- tiki-usermenu.php
- tiki-view_articles.php
- tiki-view_blog.php
- tiki-view_blog_post.php
- tiki-view_forum_thread.php
Changes:
=====================================
tiki-user_contacts_prefs.php
=====================================
@@ -13,9 +13,9 @@ $inputConfiguration = [
[
'staticKeyFilters' => [
'prefs' => 'bool', //post
- 'user_contacts_default_view' => 'bool', //post
+ 'user_contacts_default_view' => 'alpha', //post
'ext_remove' => 'int', //get
- 'ext_add' => 'string', //post
+ 'ext_add' => 'striptags', //post
'ext_show' => 'int', //get
'ext_hide' => 'int', //get
'ext_public' => 'int', //get
=====================================
tiki-user_preferences.php
=====================================
@@ -52,13 +52,17 @@ $inputConfiguration = [
'mytiki_forum_topics' => 'bool', //post
'mytiki_forum_replies' => 'bool', //post
'mytiki_items' => 'bool', //post
+ 'mytiki_articles' => 'bool', //post
'tasks_maxRecords' => 'digits', //post
'xmpp_jid' => 'striptags', //post
- 'xmpp_password' => 'striptags', //post
+ 'xmpp_password' => 'password', //post
'xmpp_custom_server_http_bind' => 'striptags', //post
- 'perspective_preferred' => 'striptags', //post
+ 'perspective_preferred' => 'digits', //post
'webmonetization_payment_pointer' => 'striptags', //post
'webmonetization_paywall_text' => 'striptags', //post
+ 'notify_oneself' => 'bool', //post
+ 'switch_user_notification' => 'bool', //post
+ 'cookie_consent_update' => 'word', //post
'chgadmin' => 'bool', //post
'pass' => 'password', //post
'email' => 'email', //post
=====================================
tiki-user_tasks.php
=====================================
@@ -12,11 +12,11 @@ $inputConfiguration = [
[
'staticKeyFilters' => [
'taskId' => 'int', //post
- 'move_task_into_trash' => 'striptags', //post
+ 'move_task_into_trash' => 'bool', //post
'update_tasks' => 'bool', //post
- 'remove_task_from_trash' => 'striptags', //post
- 'update_percentage' => 'striptags', //post
- 'action' => 'striptags', //post
+ 'remove_task_from_trash' => 'bool', //post
+ 'update_percentage' => 'bool', //post
+ 'action' => 'word', //post
'reload' => 'bool', //post
'show_trash' => 'bool', //post
'show_completed' => 'bool', //post
@@ -28,17 +28,17 @@ $inputConfiguration = [
'tasks_maxRecords' => 'int', //post
'admin_mode' => 'bool', //get
'admin_mode_off' => 'bool', //get
- 'emty_trash' => 'striptags', //get
- 'show_form' => 'striptags', //get
- 'show_history' => 'striptags', //get
- 'preview' => 'striptags', //post
- 'tiki_view_mode' => 'striptags', //post
+ 'emty_trash' => 'bool', //get
+ 'show_form' => 'alpha', //get
+ 'show_history' => 'alpha', //get
+ 'preview' => 'bool', //post
+ 'tiki_view_mode' => 'alpha', //post
'save' => 'bool', //post
'title' => 'striptags', //post
'description' => 'xss', //post
- 'start_Meridian' => 'digits', //post
+ 'start_Meridian' => 'alpha', //post
'start_Hour' => 'digits', //post
- 'end_Meridian' => 'digits', //post
+ 'end_Meridian' => 'alpha', //post
'use_start_date' => 'bool', //post
'start_Minute' => 'digits', //post
'start_Month' => 'digits', //post
@@ -54,21 +54,21 @@ $inputConfiguration = [
'task_user' => 'striptags', //post
'rights_by_creator' => 'bool', //post
'priority' => 'int', //post
- 'status' => 'striptags', //post
- 'percentage' => 'striptags', //post
+ 'status' => 'alpha', //post
+ 'percentage' => 'alnum', //post
'task_accept' => 'striptags', //post
- 'task_not_accept' => 'striptags', //post
+ 'task_not_accept' => 'bool', //post
'remove_from_trash' => 'bool', //post
'move_into_trash' => 'bool', //post
'task_send_changes_message' => 'bool', //post
'task_version' => 'digits', //post
'creator' => 'striptags', //post
- 'created' => 'striptags', //post
+ 'created' => 'digits', //post
'task_info_message' => 'striptags', //post
'send_email_newtask' => 'bool', //post
'HTTP_HOST' => 'striptags', //post
'REQUEST_URI' => 'striptags', //post
- 'sort_mode' => 'striptags', //post
+ 'sort_mode' => 'alnumdash', //post
'offset' => 'int', //get
'find' => 'striptags', //get
],
=====================================
tiki-user_watches.php
=====================================
@@ -15,10 +15,11 @@ $inputConfiguration = [
'categwatch' => 'int', //post
'id' => 'int', //post
'add' => 'bool', //post
- 'event' => 'string', //post
+ 'event' => 'striptags', //post
'delete' => 'bool', //post
+ 'langwatch' => 'lang', //post
],'staticKeyFiltersForArrays' => [
- 'cat_categories' => 'string', //post
+ 'cat_categories' => 'int', //post
'checked' => 'int', //post
],
],
=====================================
tiki-usermenu.php
=====================================
@@ -14,15 +14,15 @@ $inputConfiguration = [
'addbk' => 'bool', //post
'url' => 'url', //post
'save' => 'bool', //post
- 'name' => 'string', //post
+ 'name' => 'striptags', //post
'position' => 'int', //post
- 'mode' => 'string', //post
- 'sort_mode' => 'string', //post
+ 'mode' => 'alpha', //post
+ 'sort_mode' => 'alnumdash', //post
'offset' => 'int', //post
- 'find' => 'string', //post
+ 'find' => 'striptags', //post
],
'staticKeyFiltersForArrays' => [
- 'menu' => 'string', //post
+ 'menu' => 'int', //post
],
],
];
=====================================
tiki-view_articles.php
=====================================
@@ -15,17 +15,19 @@ $inputConfiguration = [
[
'staticKeyFilters' => [
'remove' => 'int', //post
- 'sort_mode' => 'word', //get
- 'offset' => 'digits', //get
+ 'sort_mode' => 'alnumdash', //get
+ 'offset' => 'int', //get
'date_min' => 'digits', //post
'date_max' => 'digits', //post
- 'min_rating' => 'string', //post
- 'max_rating' => 'string', //post
- 'type' => 'string', //post
- 'topic' => 'string', //post
- 'topicName' => 'string', //post
+ 'min_rating' => 'digits', //post
+ 'max_rating' => 'digits', //post
+ 'type' => 'striptags', //post
+ 'topic' => 'int', //post
+ 'topicName' => 'striptags', //post
'categId' => 'int', //post
'lang' => 'lang', //post
+ 'find' => 'striptags', //get
+ 'watch_action' => 'alpha', //get
]
],
];
=====================================
tiki-view_blog.php
=====================================
@@ -12,15 +12,18 @@ $section = 'blogs';
$inputConfiguration = [
[
'staticKeyFilters' => [
- 'blogTitle' => 'word', //get
+ 'blogTitle' => 'striptags', //get
'blogId' => 'int', //get
'remove' => 'int', //get
'offset' => 'int', //get
- 'sort_mode' => 'word', //get
- 'find' => 'word', //get
- 'date_min' => 'word', //get
- 'date_max' => 'word', //get
- 'savenotepad' => 'none', //get
+ 'sort_mode' => 'alnumdash', //get
+ 'find' => 'striptags', //get
+ 'date_min' => 'digits', //get
+ 'date_max' => 'digits', //get
+ 'savenotepad' => 'int', //get
+ 'watch_event' => 'striptags', //get
+ 'watch_action' => 'alpha', //get
+ 'watch_object' => 'int', //get
]
],
];
=====================================
tiki-view_blog_post.php
=====================================
@@ -12,14 +12,15 @@ $section = 'blogs';
$inputConfiguration = [
[
'staticKeyFilters' => [
- 'postId' => 'int', //get
- 'watch_event' => 'word', //get
- 'watch_action' => 'word', //get
- 'offset' => 'int', //get
- 'sort_mode' => 'word', //get
- 'find' => 'string', //get
- 'page' => 'int', //get
- 'savenotepad' => 'none', //get
+ 'postId' => 'int', //get
+ 'watch_event' => 'striptags', //get
+ 'watch_action' => 'alpha', //get
+ 'watch_object' => 'int', //get
+ 'offset' => 'int', //get
+ 'sort_mode' => 'alnumdash', //get
+ 'find' => 'striptags', //get
+ 'page' => 'int', //get
+ 'savenotepad' => 'int', //get
]
],
];
=====================================
tiki-view_forum_thread.php
=====================================
@@ -20,10 +20,12 @@ $inputConfiguration = [
'staticKeyFilters' => [
'comments_parentId' => 'int', //post
'threadId' => 'int', //get
+ 'forumId' => 'int', //get
+ 'locale' => 'word', //get
'topics_offset' => 'int', //get
- 'topics_sort_mode' => 'word', //get
- 'thread_sort_mode' => 'word', //get
- 'topics_find' => 'word', //get
+ 'topics_sort_mode' => 'alnumdash', //get
+ 'thread_sort_mode' => 'alnumdash', //get
+ 'topics_find' => 'striptags', //get
'topics_threshold' => 'int', //get
'quote' => 'int', //get
'time_control' => 'int', //get
@@ -33,13 +35,14 @@ $inputConfiguration = [
'comments_reply_threadId' => 'int', //get
'lock' => 'bool', //get
'display' => 'word', //get
- 'archive' => 'url', //post
+ 'archive' => 'bool', //post
'report' => 'int', //get
'post_reported' => 'word', //get
'comments_per_page' => 'int', //get
- 'savenotepad' => 'bool', //get
- 'watch_event' => 'word', //get
- 'watch_object' => 'word', //get
+ 'savenotepad' => 'int', //get
+ 'watch_event' => 'striptags', //get
+ 'watch_action' => 'alpha', //get
+ 'watch_object' => 'int', //get
'view_atts' => 'bool', //get
'fa_offset' => 'int', //get
'fa_maxRecords' => 'int', //get
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/88a6dadeef89ed8409371542ae5113db93e67f12
--
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/88a6dadeef89ed8409371542ae5113db93e67f12
You're receiving this email because of your account on gitlab.com.
_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs