Security fix: Only allow PUT requests to Report action.
This commit is contained in:
parent
76fc1e5363
commit
d51e44b132
|
@ -6,6 +6,10 @@ abstract class AbstractAction
|
||||||
{
|
{
|
||||||
public abstract function handle();
|
public abstract function handle();
|
||||||
|
|
||||||
|
public function get_request_method() {
|
||||||
|
return strtolower($_SERVER["REQUEST_METHOD"]);
|
||||||
|
}
|
||||||
|
|
||||||
public function param_exists($key) {
|
public function param_exists($key) {
|
||||||
return !empty($_GET[$key]);
|
return !empty($_GET[$key]);
|
||||||
}
|
}
|
||||||
|
|
|
@ -21,6 +21,9 @@ class Report extends \Sandpiper\AbstractAction
|
||||||
|
|
||||||
header("content-type: text/plain");
|
header("content-type: text/plain");
|
||||||
|
|
||||||
|
if($this->get_request_method() !== "PUT")
|
||||||
|
\send_error(405, "Only PUT requests to this action are allowed.");
|
||||||
|
|
||||||
if(!$this->param_exists("place_id"))
|
if(!$this->param_exists("place_id"))
|
||||||
exit("Error: No place id provided.\n");
|
exit("Error: No place id provided.\n");
|
||||||
if(!$this->param_exists("summary"))
|
if(!$this->param_exists("summary"))
|
||||||
|
|
Reference in a new issue