Agenda: Fix type paremeter #security

5 years ago · d939402d83
parent 33754fe29d
commit d939402d83
1 changed files with 2 additions and 1 deletions
--- a/main/calendar/agenda_list.php
+++ b/main/calendar/agenda_list.php
@ -12,7 +12,8 @@ $logInfo = [
 ];
 Event::registerLog($logInfo);

-$type = isset($_REQUEST['type']) ? $_REQUEST['type'] : null;
+$typeList = ['personal', 'course', 'admin', 'platform'];
+$type = isset($_REQUEST['type']) && in_array($_REQUEST['type'], $typeList, true) ? $_REQUEST['type'] : null;

 $interbreadcrumb[] = [
    'url' => api_get_path(WEB_CODE_PATH).'calendar/agenda_js.php?type='.Security::remove_XSS($type),