Skip to content
Snippets Groups Projects
Commit a954f43c authored by Hahn Axel (hahn)'s avatar Hahn Axel (hahn)
Browse files

valuestore: disallow GET for action=update

parent 9d95789b
No related branches found
No related tags found
1 merge request!70valuestore: disallow GET for action=update
......@@ -87,6 +87,12 @@ function getParam(string $sKey, string $sRegex4Cleanup = ''): bool|int|string
*/
function disallowGet(string $sVar, string $sValue): void
{
if (isset($_POST[$sVar]) && $_POST[$sVar] == $sValue) {
// the value was found in the POST scope
// then we don't need to check the GET scope
return;
}
if (isset($_GET[$sVar]) && $_GET[$sVar] == $sValue) {
quit("ERROR: $sVar = $sValue is not allowed with GET.");
}
......@@ -108,9 +114,7 @@ if (
}
disallowGet('action', 'cleanup');
disallowGet('action', 'delete');
// used by Anasible to update the value ... I disable it for now to fix it in the near future
// disallowGet('action', 'update');
disallowGet('action', 'update');
$sProject = getParam('project', '/[^a-z\-\_0-9]/');
$sPackage = getParam('package', '/[^a-z\-\_0-9]/');
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment