[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [FIX] Update input configuration and request handling for rankings

Espoir Baraka pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
0a71cf00 by Espoir Baraka at 2026-08-17T17:23:13+02:00
[FIX] Update input configuration and request handling for rankings
---
* [FIX] Update input configuration and request handling for rankings
---
* [FIX] Update input configuration and request handling for rankings

(cherry picked from commit c42c84e3a29765160717a959c34308526aa9790c)

See merge request tikiwiki/tiki!10910

(cherry picked from commit bfd07ec79412a91d811f90293f2896dd9b24b1ed)

See merge request tikiwiki/tiki!10915

- - - - -


5 changed files:

- tiki-blog_rankings.php
- tiki-cms_rankings.php
- tiki-file_galleries_rankings.php
- tiki-forum_rankings.php
- tiki-wiki_rankings.php


Changes:

=====================================
tiki-blog_rankings.php
=====================================
@@ -11,8 +11,8 @@
 $inputConfiguration = [
     [
         'staticKeyFilters'                => [
-            'which'                    => 'string',              //post
-            'limit'                    => 'string',              //post
+            'which'                    => 'word',                //post
+            'limit'                    => 'digits',              //post
         ],
     ]
 ];
@@ -39,17 +39,18 @@ $allrankings = [
     ]
 ];
 $smarty->assign('allrankings', $allrankings);
-if (! isset($_REQUEST["which"])) {
-    $which = 'blog_ranking_top_blogs';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'blog_ranking_top_blogs';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
 $smarty->assign('which', $which);
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 $smarty->assign_by_ref('limit', $limit);
 // Rankings:


=====================================
tiki-cms_rankings.php
=====================================
@@ -11,8 +11,8 @@
 $inputConfiguration = [
     [
         'staticKeyFilters'                => [
-            'which '                      => 'text',     //post
-            'limit'                       => 'text',     //post
+            'which'                       => 'word',     //post
+            'limit'                       => 'digits',   //post
         ],
     ],
 ];
@@ -37,8 +37,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'cms_ranking_top_articles';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'cms_ranking_top_articles';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -46,10 +48,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-file_galleries_rankings.php
=====================================
@@ -41,8 +41,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'filegal_ranking_top_files';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'filegal_ranking_top_files';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -50,10 +52,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-forum_rankings.php
=====================================
@@ -55,8 +55,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'forums_ranking_last_topics';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'forums_ranking_last_topics';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -64,10 +66,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-wiki_rankings.php
=====================================
@@ -9,6 +9,15 @@
 // All Rights Reserved. See copyright.txt for details and a complete list of authors.
 // Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
 $section_class = "tiki_wiki_page manage";   // This will be body class instead of $section
+$inputConfiguration = [
+    [
+        'staticKeyFilters'                => [
+            'which'                     => 'word',              //post
+            'limit'                     => 'digits',            //post
+            'categId'                   => 'striptags',         //get
+        ],
+    ],
+];
 require_once('tiki-setup.php');
 
 use Tiki\Sections;
@@ -20,10 +29,9 @@ include_once('lib/rankings/ranklib.php');
 $access->check_feature(['feature_wiki', 'feature_wiki_rankings']);
 $access->check_permission('tiki_p_view');
 
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $categs = [];
@@ -59,8 +67,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'wiki_ranking_top_pages';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'wiki_ranking_top_pages';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/0a71cf007fa5bbd48709514ffa95d169da349bf1

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/0a71cf007fa5bbd48709514ffa95d169da349bf1
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs