← All changes | framework/mvc/controller.inc.php +5 -42 trunk → 11.7 View file →

		@@ -109,10 +109,8 @@
109	109	// Initialize hookable!
110	110	parent::__construct();
111	111	// Read request parameters.
112	112	$this->request = array_merge(((array) $_REQUEST), ((array) $request));
113		-
114		- $overrideControllerPath = $overrideControllerPath ? null : '';
115	113	// Create default model.
116	114	if (isset($this->controllerInfo['model'])) {
117	115	// E_ALL complain!
118	116	if (!isset($this->controllerInfo['model_file'])) {
		@@ -126,9 +124,9 @@
126	124	}
127	125	// Create default view.
128	126	if ($hasView === null) { // Default value for $hasView = true
129	127	// Request/passed parameters has priority over controller default view!
130		- $view = $this->ongetviewname(isset($this->request['view']) ? esc_html($this->request['view']) :
	128	+ $view = $this->ongetviewname(isset($this->request['view']) ? $this->request['view'] :
131	129	(isset($this->controllerInfo['view']) ? $this->controllerInfo['view'] : null)
132	130	);
133	131	if ($view) {
134	132	$this->view = self::getView($view,
		@@ -149,9 +147,9 @@
149	147	public function _doAction() {
150	148	// Force use of internal action untless its empty
151	149	// then look for submitted action or get the default!
152	150	$action = $this->action ? $this->action :
153		- (isset($_GET['action']) ? esc_html($_GET['action']) : $this->defaultAction);
	151	+ (isset($_GET['action']) ? $_GET['action'] : $this->defaultAction);
154	152	// filter action name!
155	153	$action = $this->ongetactionname($action);
156	154	if ($action) {
157	155	$actionHandler = "{$action}Action";
		@@ -175,13 +173,8 @@
175	173	$hasView = null,
176	174	$request = null,
177	175	$overrideControllersPath = null,
178	176	$overrideControllersPrefix = null) {
179		- // Validate controller name to prevent path traversal attacks
180		- if (!self::isValidControllerName($name)) {
181		- throw new Exception('Invalid controller name: ' . esc_html($name));
182		- }
183		-
184	177	// Import controller file.
185	178	$pathToControllers = $overrideControllersPath ? $overrideControllersPath : CJTOOLBOX_CONTROLLERS_PATH;
186	179	$controllerFile = "{$pathToControllers}/{$name}.php";
187	180	require_once self::trigger('CJTController.loadcontroller', $controllerFile, $name);
		@@ -191,38 +184,8 @@
191	184	return new $class($hasView, $request, $overrideControllersPath, $overrideControllersPrefix);
192	185	}
193	186
194	187	/**
195		- * Validate controller name to prevent path traversal attacks
196		- *
197		- * @param string $name Controller name to validate
198		- * @return bool True if valid, false otherwise
199		- */
200		- private static function isValidControllerName($name) {
201		- // Check for null or empty string
202		- if (empty($name) || !is_string($name)) {
203		- return false;
204		- }
205		-
206		- // Check for path traversal attempts
207		- if (strpos($name, '..') !== false) {
208		- return false;
209		- }
210		-
211		- // Check for directory separators
212		- if (strpos($name, '/') !== false || strpos($name, '\\') !== false) {
213		- return false;
214		- }
215		-
216		- // Only allow alphanumeric characters, hyphens, and underscores
217		- if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name)) {
218		- return false;
219		- }
220		-
221		- return true;
222		- }
223		-
224		- /**
225	188	* put your comment there...
226	189	*
227	190	* @deprecated Use cssJSToolbox::createSecurityToken
228	191	*/
		@@ -235,9 +198,9 @@
235	198	*
236	199	*/
237	200	protected function displayAction() {
238	201	// Get view layout!
239		- $layout = isset($this->request['layout']) ? esc_html($this->request['layout']) : 'default';
	202	+ $layout = isset($this->request['layout']) ? $this->request['layout'] : 'default';
240	203	ob_start();
241	204	$this->view->display($layout);
242	205	$content = ob_get_clean();
243	206	return $content;
		@@ -310,9 +273,9 @@
310	273	*
311	274	* @param mixed $name
312	275	*/
313	276	public function getRequestParameter($name) {
314		- return isset($this->request[$name]) ? esc_html($this->request[$name]) : null;
	277	+ return isset($this->request[$name]) ? $this->request[$name] : null;
315	278	}
316	279
317	280	/**
318	281	*
		@@ -383,5 +346,5 @@
383	346
384	347	} // End class.
385	348
386	349	// Hookable!
387		-CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));
	350	+CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));