diff --git a/endpoints/account/reset-password.php b/endpoints/account/reset-password.php index 44c39b0b..c9abf6a8 100644 --- a/endpoints/account/reset-password.php +++ b/endpoints/account/reset-password.php @@ -25,7 +25,7 @@ class AccountresetpasswordResponse extends TemplateResponse protected array $expectedGET = array( 'key' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[a-zA-Z0-9]{40}$/']], - 'next' => ['filter' => FILTER_SANITIZE_URL, 'flags' => FILTER_FLAG_STRIP_AOWOW ] + 'next' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/' ]] ); protected array $expectedPOST = array( 'key' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[a-zA-Z0-9]{40}$/']], diff --git a/endpoints/account/signin.php b/endpoints/account/signin.php index ffcd15b7..9beea099 100644 --- a/endpoints/account/signin.php +++ b/endpoints/account/signin.php @@ -28,7 +28,7 @@ class AccountSigninResponse extends TemplateResponse ); protected array $expectedGET = array( 'key' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[a-zA-Z0-9]{40}$/']], - 'next' => ['filter' => FILTER_SANITIZE_URL, 'flags' => FILTER_FLAG_STRIP_AOWOW ] + 'next' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/'] ] ); private bool $success = false; diff --git a/endpoints/account/signout.php b/endpoints/account/signout.php index 7447f92e..67eaeacf 100644 --- a/endpoints/account/signout.php +++ b/endpoints/account/signout.php @@ -11,8 +11,8 @@ class AccountSignoutResponse extends TextResponse use TrGetNext; protected array $expectedGET = array( - 'next' => ['filter' => FILTER_SANITIZE_URL, 'flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH], - 'global' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkEmptySet'] ] + 'next' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/']], + 'global' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkEmptySet'] ] ); public function __construct(string $pageParam) diff --git a/endpoints/account/signup.php b/endpoints/account/signup.php index 734832b1..5fd827b5 100644 --- a/endpoints/account/signup.php +++ b/endpoints/account/signup.php @@ -26,7 +26,7 @@ class AccountSignupResponse extends TemplateResponse ); protected array $expectedGET = array( - 'next' => ['filter' => FILTER_SANITIZE_URL, 'flags' => FILTER_FLAG_STRIP_AOWOW] + 'next' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/']] ); private bool $success = false; diff --git a/endpoints/contactus/contactus.php b/endpoints/contactus/contactus.php index 196ad9c6..ace3fa02 100644 --- a/endpoints/contactus/contactus.php +++ b/endpoints/contactus/contactus.php @@ -9,15 +9,15 @@ if (!defined('AOWOW_REVISION')) class ContactusBaseResponse extends TextResponse { protected array $expectedPOST = array( - 'mode' => ['filter' => FILTER_VALIDATE_INT ], - 'reason' => ['filter' => FILTER_VALIDATE_INT ], - 'ua' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine']], - 'appname' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine']], - 'page' => ['filter' => FILTER_SANITIZE_URL ], - 'desc' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextBlob']], - 'id' => ['filter' => FILTER_VALIDATE_INT ], - 'relatedurl' => ['filter' => FILTER_SANITIZE_URL ], - 'email' => ['filter' => FILTER_SANITIZE_EMAIL ] + 'mode' => ['filter' => FILTER_VALIDATE_INT ], + 'reason' => ['filter' => FILTER_VALIDATE_INT ], + 'ua' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine'] ], + 'appname' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine'] ], + 'page' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/']], + 'desc' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextBlob'] ], + 'id' => ['filter' => FILTER_VALIDATE_INT ], + 'relatedurl' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[[:print:]]+$/']], + 'email' => ['filter' => FILTER_SANITIZE_EMAIL ] ); /* responses