← All changes | src/Controller/BaseControllerTrait.php +27 -25 trunk → 2.3.13 View file →

		@@ -9,35 +9,36 @@
9	9	use UserAccessManager\Wrapper\Php;
10	10
11	11	trait BaseControllerTrait
12	12	{
13		- protected ?string $template = null;
14		-
15	13	abstract protected function getPhp(): Php;
16		-
17	14	abstract protected function getWordpressConfig(): WordpressConfig;
	15	+ protected ?string $template = null;
18	16
19	17	public function getRequestUrl(): string
20	18	{
21		- return htmlentities($_SERVER['REQUEST_URI'] ?? '', ENT_QUOTES);
	19	+ return htmlentities($_SERVER['REQUEST_URI'], ENT_NOQUOTES);
22	20	}
23	21
24	22	private function sanitizeValue(mixed $value): mixed
25	23	{
26		- if (is_array($value) === true) {
27		- $sanitized = [];
	24	+ if (is_object($value) === true) {
	25	+ return $value;
	26	+ } elseif (is_array($value) === true) {
	27	+ $newValue = [];
28	28
29	29	foreach ($value as $key => $arrayValue) {
30		- $sanitized[$this->sanitizeValue($key)] = $this->sanitizeValue($arrayValue);
	30	+ $sanitizedKey = $this->sanitizeValue($key);
	31	+ $newValue[$sanitizedKey] = $this->sanitizeValue($arrayValue);
31	32	}
32	33
33		- return $sanitized;
	34	+ $value = $newValue;
	35	+ } elseif (is_string($value) === true) {
	36	+ $value = preg_replace('/\\+(["|\'])/', '$1', $value);
	37	+ $value = stripslashes($value);
	38	+ $value = htmlspecialchars($value, ENT_NOQUOTES);
34	39	}
35	40
36		- if (is_string($value) === true) {
37		- return htmlspecialchars(stripslashes($value), ENT_QUOTES);
38		- }
39		-
40	41	return $value;
41	42	}
42	43
43	44	public function getRequestParameter(string $name, mixed $default = null): mixed
		@@ -52,24 +53,25 @@
52	53	}
53	54
54	55	protected function getIncludeContents(string $fileName): string
55	56	{
	57	+ $contents = '';
56	58	$realPath = rtrim($this->getWordpressConfig()->getRealPath(), DIRECTORY_SEPARATOR);
57		- $fileWithPath = implode(DIRECTORY_SEPARATOR, [$realPath, 'src', 'View', $fileName]);
	59	+ $path = [$realPath, 'src', 'View'];
	60	+ $path = implode(DIRECTORY_SEPARATOR, $path).DIRECTORY_SEPARATOR;
	61	+ $fileWithPath = $path.$fileName;
58	62
59		- if (is_file($fileWithPath) === false) {
60		- return '';
	63	+ if (is_file($fileWithPath) === true) {
	64	+ try {
	65	+ ob_start();
	66	+ $this->getPhp()->includeFile($this, $fileWithPath);
	67	+ $contents = ob_get_contents();
	68	+ ob_end_clean();
	69	+ } catch (Exception $exception) {
	70	+ $contents = "Error on including content '$fileWithPath': {$exception->getMessage()}";
	71	+ ob_end_clean();
	72	+ }
61	73	}
62		-
63		- try {
64		- ob_start();
65		- $this->getPhp()->includeFile($this, $fileWithPath);
66		- $contents = ob_get_contents();
67		- } catch (Exception $exception) {
68		- $contents = "Error on including content '$fileWithPath': {$exception->getMessage()}";
69		- }
70		-
71		- ob_end_clean();
72	74
73	75	return $contents;
74	76	}
75	77