Comunic/ComunicAPI
1
0
Fork 0
mirror of https://github.com/pierre42100/ComunicAPI synced 2025-11-04 12:14:12 +00:00
Code Issues Projects Releases Wiki Activity

Improved security of "sendRequest" method

Browse Source
This commit is contained in:
Pierre
2017-12-24 16:48:08 +01:00
parent e8b448ea86
commit bdf47b9c26
3 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
RestControllers/friendsController.php
View File

@@ -44,6 +44,14 @@ class friendsController{
//Extract informations and process request //Extract informations and process request
$friendID = toInt($_POST['friendID']); $friendID = toInt($_POST['friendID']);
//Check friendID validity
if(!check_user_id($friendID))
Rest_fatal_error(401, "The user ID you specified is invalid !");
//Check if the user exists
if(!CS::get()->components->user->exists($friendID))
Rest_fatal_error(401, "Specifed user does not exist!");
//Check if the two persons are already friend //Check if the two persons are already friend
if(CS::get()->components->friends->are_friend(userID, $friendID)) if(CS::get()->components->friends->are_friend(userID, $friendID))
Rest_fatal_error(401, "The two personns are already friend !"); Rest_fatal_error(401, "The two personns are already friend !");

2
classes/components/user.php
View File

@@ -295,7 +295,7 @@ class User{
* @param Integer $userID The ID of the user to check * @param Integer $userID The ID of the user to check
* @return Boolean Depends of the existence of the user * @return Boolean Depends of the existence of the user
*/ */
public function exists($userID){ public function exists(int $userID) : bool {
//Perform a request on the database //Perform a request on the database
$tableName = $this->userTable; $tableName = $this->userTable;
$condition = "WHERE ID = ?"; $condition = "WHERE ID = ?";

14
functions/requests.php
View File

@@ -119,4 +119,18 @@ function safe_for_sql(string $input) : string {
return $input; return $input;
}
/**
* Check a given user ID
*
* @param int $userID The user ID to check
* @return bool True if userID is valid, false else
*/
function check_user_id(int $userID) : bool {
if($userID < 1)
return false; //Invalid
return true; //Valid
} }