com web/php: make sure params are strings for manual-lookup.php (bug #61756): include/langchooser.inc manual-lookup.php

Commit: ee6c0e89afea5f3b4682bbaf37a31929f6435ac9 Author: Peter Cowburn <petercowburn@gmail.com> Tue, 17 Apr 2012 22:30:31 +0100 Parents: 09ca235df41d90e49b6aebe41fc2246ffbce359c Branches: master Link: http://git.php.net/?p=web/php.git;a=commitdiff;h=ee6c0e89afea5f3b4682bbaf37a31929f6435ac9 Log: make sure params are strings for manual-lookup.php (bug #61756) Bugs: https://bugs.php.net/61756 Changed paths: M include/langchooser.inc M manual-lookup.php Diff: diff --git a/include/langchooser.inc b/include/langchooser..inc index 243f12b..f5d6d1d 100644 --- a/include/langchooser.inc +++ b/include/langchooser.inc @@ -50,7 +50,7 @@ function language_choose_code() $explicitly_specified = ''; $selected = ''; // Specified for the request (GET/POST parameter) - if (!empty($_REQUEST['lang'])) { + if (!empty($_REQUEST['lang']) && is_string($_REQUEST['lang'])) { $explicitly_specified = language_add(htmlspecialchars($_REQUEST['lang'], ENT_QUOTES, 'UTF-8'), $languages); // Set the language in a cookie for a year diff --git a/manual-lookup.php b/manual-lookup.php index 77abd64..9d03da9 100644 --- a/manual-lookup.php +++ b/manual-lookup.php @@ -8,15 +8,13 @@ include $_SERVER['DOCUMENT_ROOT'] . '/include/manual-lookup.inc'; // BC code, so pattern and function can both be used as // parameters to specify the function name $function = ''; -if (empty($_GET['function'])) { - if (!empty($_GET['pattern'])) { - $function = htmlspecialchars($_GET['pattern'], ENT_QUOTES, 'UTF-8'); - } -} else { +if (!empty($_GET['function']) && is_string($_GET['function'])) { $function = htmlspecialchars($_GET['function'], ENT_QUOTES, 'UTF-8'); +} elseif (!empty($_GET['pattern']) && is_string($_GET['pattern'])) { + $function = htmlspecialchars($_GET['pattern'], ENT_QUOTES, 'UTF-8'); } -if(!empty($_GET['scope'])) { +if(!empty($_GET['scope']) && is_string($_GET['scope'])) { $scope = htmlspecialchars($_GET['scope'], ENT_QUOTES, 'UTF-8'); } else { $scope = '';