saisie sécurisée

2 files changed, 19 insertions, 6 deletions

diff --git a/src/controller/Security.php b/src/controller/Security.php
index cd31cb8..b882d42 100644
--- a/src/controller/Security.php
+++ b/src/controller/Security.php
@@ -22,7 +22,7 @@ class Security
         // ATTENTION, n'applique pas htmlspecialchars() !!
         public static function secureString(string $chaine): string
         {
-            return trim(htmLawed($chaine, self::$configHtmLawed, self::$specHtmLawed));;
+            return trim(htmLawed($chaine, self::$configHtmLawed, self::$specHtmLawed));
         }
 
         public static function secureFileName(string $chaine): string
diff --git a/src/controller/ajax_calendar.php b/src/controller/ajax_calendar.php
index 834c88b..79268f6 100644
--- a/src/controller/ajax_calendar.php
+++ b/src/controller/ajax_calendar.php
@@ -46,22 +46,35 @@ elseif(isset($_SESSION['admin']) && $_SESSION['admin'] === true
         $json = json_decode($data, true);
         
         if($_GET['action'] === 'new_event'){
-        $event = new Event($json['title'], $json['start'], $json['end'], $json['allDay'], $json["description"], $json['color']);
-        
+        try{
+            $event = new Event($json);
+        }
+        catch(InvalidArgumentException $e){
+            echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+            http_response_code(400);
+            die;
+        }
         $entityManager->persist($event);
         $entityManager->flush();
                 
                 echo json_encode(['success' => true, 'id' => $event->getId()]);
         }
         elseif($_GET['action'] === 'update_event'){
-        $event = $entityManager->find('App\Entity\Event', $json['id']);
-        $event->updateFromJSON($json);
+        $event = $entityManager->find('App\Entity\Event', (int)$json['id']);
+        try{
+            $event->securedUpdateFromJSON($json);
+        }
+        catch(InvalidArgumentException $e){
+            echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+            http_response_code(400);
+            die;
+        }
         $entityManager->flush();
 
                 echo json_encode(['success' => true]);
         }
         elseif($_GET['action'] === 'remove_event'){
-        $event = $entityManager->find('App\Entity\Event', $json['id']);
+        $event = $entityManager->find('App\Entity\Event', (int)$json['id']);
         $entityManager->remove($event);
         $entityManager->flush();