lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add method checkValForAPI to clean data from API input

Browse Source
This commit is contained in:
Laurent Destailleur 2021-04-27 01:05:14 +02:00
parent 29b1f2b58a
commit f54d14bfd6
4 changed files with 22 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
htdocs/api/class/api.class.php
View File

@ -73,22 +73,24 @@ class DolibarrApi
} }
/** /**
* Executed method when API is called without parameter * Check and convert a string depending on its type/name.
* *
* Display a short message an return a http code 200 * Display a short message an return a http code 200
* *
* @return array * @param string $field Field name
* @param string $value Value to check/clean
* @param stdClass $object Object
* @return string Value cleaned
*/ */
/* Disabled, most APIs does not share same signature for method index protected function checkValForAPI($field, $value, $object)
function index()
{ {
return array( // TODO Use type detected in $object->fields
'success' => array( if (in_array($field, array('note', 'note_private', 'note_public', 'desc', 'description'))) {
'code' => 200, return checkVal($value, 'restricthtml');
'message' => __class__.' is up and running!' } else {
) return checkVal($value, 'alphanohtml');
); }
}*/ }
// phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
/** /**

8
htdocs/comm/action/class/api_agendaevents.class.php
View File

@ -217,7 +217,7 @@ class AgendaEvents extends DolibarrApi
$result = $this->_validate($request_data); $result = $this->_validate($request_data);
foreach ($request_data as $field => $value) { foreach ($request_data as $field => $value) {
$this->actioncomm->$field = $value; $this->actioncomm->$field = $this->checkValForAPI($field, $value, $this->actioncomm);
} }
/*if (isset($request_data["lines"])) { /*if (isset($request_data["lines"])) {
$lines = array(); $lines = array();
@ -226,6 +226,7 @@ class AgendaEvents extends DolibarrApi
} }
$this->expensereport->lines = $lines; $this->expensereport->lines = $lines;
}*/ }*/
if ($this->actioncomm->create(DolibarrApiAccess::$user) < 0) { if ($this->actioncomm->create(DolibarrApiAccess::$user) < 0) {
throw new RestException(500, "Error creating event", array_merge(array($this->actioncomm->error), $this->actioncomm->errors)); throw new RestException(500, "Error creating event", array_merge(array($this->actioncomm->error), $this->actioncomm->errors));
} }
@ -268,7 +269,8 @@ class AgendaEvents extends DolibarrApi
if ($field == 'id') { if ($field == 'id') {
continue; continue;
} }
$this->actioncomm->$field = $value;
$this->actioncomm->$field = $this->checkValForAPI($field, $value, $this->actioncomm);
} }
if ($this->actioncomm->update(DolibarrApiAccess::$user, 1) > 0) { if ($this->actioncomm->update(DolibarrApiAccess::$user, 1) > 0) {
@ -299,7 +301,7 @@ class AgendaEvents extends DolibarrApi
} }
if (!DolibarrApiAccess::$user->rights->agenda->allactions->delete && DolibarrApiAccess::$user->id != $this->actioncomm->userownerid) { if (!DolibarrApiAccess::$user->rights->agenda->allactions->delete && DolibarrApiAccess::$user->id != $this->actioncomm->userownerid) {
throw new RestException(401, "Insufficient rights to delete an Agenda Event of owner id ".$request_data['userownerid'].' Your id is '.DolibarrApiAccess::$user->id); throw new RestException(401, "Insufficient rights to delete an Agenda Event of owner id ".$this->actioncomm->userownerid.' Your id is '.DolibarrApiAccess::$user->id);
} }
if (!$result) { if (!$result) {

5
htdocs/compta/bank/class/api_bankaccounts.class.php
View File

@ -29,7 +29,6 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
*/ */
class BankAccounts extends DolibarrApi class BankAccounts extends DolibarrApi
{ {
/** /**
* array $FIELDS Mandatory fields, checked when creating an object * array $FIELDS Mandatory fields, checked when creating an object
*/ */
@ -158,7 +157,7 @@ class BankAccounts extends DolibarrApi
$account = new Account($this->db); $account = new Account($this->db);
foreach ($request_data as $field => $value) { foreach ($request_data as $field => $value) {
$account->$field = $value; $account->$field = $this->checkValForAPI($field, $value, $account);
} }
// Date of the initial balance (required to create an account). // Date of the initial balance (required to create an account).
$account->date_solde = time(); $account->date_solde = time();
@ -333,7 +332,7 @@ class BankAccounts extends DolibarrApi
if ($field == 'id') { if ($field == 'id') {
continue; continue;
} }
$account->$field = $value; $account->$field = $this->checkValForAPI($field, $value, $account);
} }
if ($account->update(DolibarrApiAccess::$user) > 0) { if ($account->update(DolibarrApiAccess::$user) > 0) {

4
htdocs/modulebuilder/template/class/api_mymodule.class.php
View File

@ -213,7 +213,7 @@ class MyModuleApi extends DolibarrApi
$result = $this->_validate($request_data); $result = $this->_validate($request_data);
foreach ($request_data as $field => $value) { foreach ($request_data as $field => $value) {
$this->myobject->$field = $value; $this->myobject->$field = $this->checkValForAPI($field, $value, $this->myobject);
} }
// Clean data // Clean data
@ -255,7 +255,7 @@ class MyModuleApi extends DolibarrApi
if ($field == 'id') { if ($field == 'id') {
continue; continue;
} }
$this->myobject->$field = $value; $this->myobject->$field = $this->checkValForAPI($field, $value, $this->myobject);
} }
// Clean data // Clean data