[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [FIX] Update input configuration and request handling for rankings

Espoir Baraka pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
42ae2670 by Espoir Baraka at 2026-08-18T10:07:24+02:00
[FIX] Update input configuration and request handling for rankings
---
* [FIX] Update input configuration and request handling for rankings
---
* [FIX] Update input configuration and request handling for rankings
---
* [FIX] Update input configuration and request handling for rankings

(cherry picked from commit c42c84e3a29765160717a959c34308526aa9790c)

See merge request tikiwiki/tiki!10910

(cherry picked from commit bfd07ec79412a91d811f90293f2896dd9b24b1ed)

See merge request tikiwiki/tiki!10915

(cherry picked from commit 0a71cf007fa5bbd48709514ffa95d169da349bf1)

See merge request tikiwiki/tiki!10930

- - - - -


5 changed files:

- tiki-blog_rankings.php
- tiki-cms_rankings.php
- tiki-file_galleries_rankings.php
- tiki-forum_rankings.php
- tiki-wiki_rankings.php


Changes:

=====================================
tiki-blog_rankings.php
=====================================
@@ -12,8 +12,8 @@ $section = 'blogs';
 $inputConfiguration = [
     [
         'staticKeyFilters'                => [
-            'which'                    => 'string',              //post
-            'limit'                    => 'string',              //post
+            'which'                    => 'word',                //post
+            'limit'                    => 'digits',              //post
         ],
     ]
 ];
@@ -37,17 +37,18 @@ $allrankings = [
     ]
 ];
 $smarty->assign('allrankings', $allrankings);
-if (! isset($_REQUEST["which"])) {
-    $which = 'blog_ranking_top_blogs';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'blog_ranking_top_blogs';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
 $smarty->assign('which', $which);
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 $smarty->assign_by_ref('limit', $limit);
 // Rankings:


=====================================
tiki-cms_rankings.php
=====================================
@@ -12,8 +12,8 @@ $section = 'cms';
 $inputConfiguration = [
     [
         'staticKeyFilters'                => [
-            'which '                      => 'text',     //post
-            'limit'                       => 'text',     //post
+            'which'                       => 'word',     //post
+            'limit'                       => 'digits',   //post
         ],
     ],
 ];
@@ -35,8 +35,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'cms_ranking_top_articles';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'cms_ranking_top_articles';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -44,10 +46,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-file_galleries_rankings.php
=====================================
@@ -41,8 +41,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'filegal_ranking_top_files';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'filegal_ranking_top_files';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -50,10 +52,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-forum_rankings.php
=====================================
@@ -54,8 +54,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'forums_ranking_last_topics';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'forums_ranking_last_topics';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }
@@ -63,10 +65,9 @@ if (! isset($_REQUEST["which"])) {
 $smarty->assign('which', $which);
 
 // Get the page from the request var or default it to HomePage
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $smarty->assign_by_ref('limit', $limit);


=====================================
tiki-wiki_rankings.php
=====================================
@@ -10,6 +10,15 @@
 // Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
 $section = 'wiki page';
 $section_class = "tiki_wiki_page manage";   // This will be body class instead of $section
+$inputConfiguration = [
+    [
+        'staticKeyFilters'                => [
+            'which'                     => 'word',              //post
+            'limit'                     => 'digits',            //post
+            'categId'                   => 'striptags',         //get
+        ],
+    ],
+];
 require_once('tiki-setup.php');
 
 include_once('lib/rankings/ranklib.php');
@@ -17,10 +26,9 @@ include_once('lib/rankings/ranklib.php');
 $access->check_feature(['feature_wiki', 'feature_wiki_rankings']);
 $access->check_permission('tiki_p_view');
 
-if (! isset($_REQUEST["limit"])) {
+$limit = isset($_REQUEST["limit"]) ? (int) $_REQUEST["limit"] : 10;
+if ($limit < 1) {
     $limit = 10;
-} else {
-    $limit = $_REQUEST["limit"];
 }
 
 $categs = [];
@@ -56,8 +64,10 @@ $allrankings = [
 
 $smarty->assign('allrankings', $allrankings);
 
-if (! isset($_REQUEST["which"])) {
-    $which = 'wiki_ranking_top_pages';
+$allowedRankings = array_column($allrankings, 'value');
+$defaultWhich = 'wiki_ranking_top_pages';
+if (! isset($_REQUEST["which"]) || ! in_array($_REQUEST["which"], $allowedRankings, true)) {
+    $which = $defaultWhich;
 } else {
     $which = $_REQUEST["which"];
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/42ae26708f154036238b36412844a8b8bc49d0cd

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/42ae26708f154036238b36412844a8b8bc49d0cd
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs