Commit b113764b authored by Lukas Fleischer's avatar Lukas Fleischer
Browse files

Sanitize merge base name in pkgreq_file()

Move the check introduced in 06b70993

 (Validate package base name when
filing requests, 2014-07-02) from pkgbase.php to pkgreq_file().

Signed-off-by: default avatarLukas Fleischer <archlinux@cryptocrack.de>
parent 87215cef
......@@ -98,12 +98,7 @@ if (check_token()) {
} elseif (current_action("do_ChangeCategory")) {
list($ret, $output) = pkgbase_change_category($base_id, $atype);
} elseif (current_action("do_FileRequest")) {
if (empty($_POST['merge_into']) || preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $_POST['merge_into'])) {
list($ret, $output) = pkgreq_file($ids, $_POST['type'], $_POST['merge_into'], $_POST['comments']);
} else {
$output = __("Invalid name: only lowercase letters are allowed.");
$ret = false;
}
list($ret, $output) = pkgreq_file($ids, $_POST['type'], $_POST['merge_into'], $_POST['comments']);
} elseif (current_action("do_CloseRequest")) {
list($ret, $output) = pkgreq_close($_POST['reqid'], $_POST['reason'], $_POST['comments']);
}
......
......@@ -72,6 +72,10 @@ function pkgreq_file($ids, $type, $merge_into, $comments) {
global $AUR_LOCATION;
global $AUR_REQUEST_ML;
if (!empty($merge_into) && !preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $merge_into)) {
return array(false, __("Invalid name: only lowercase letters are allowed."));
}
if (empty($comments)) {
return array(false, __("The comment field must not be empty."));
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment