saisie sécurisée

3 files changed, 37 insertions, 20 deletions

diff --git a/src/controller/Security.php b/src/controller/Security.php
index cd31cb8..b882d42 100644
--- a/src/controller/Security.php
+++ b/src/controller/Security.php
@@ -22,7 +22,7 @@ class Security
         // ATTENTION, n'applique pas htmlspecialchars() !!
         public static function secureString(string $chaine): string
         {
-            return trim(htmLawed($chaine, self::$configHtmLawed, self::$specHtmLawed));;
+            return trim(htmLawed($chaine, self::$configHtmLawed, self::$specHtmLawed));
         }
 
         public static function secureFileName(string $chaine): string
diff --git a/src/controller/ajax_calendar.php b/src/controller/ajax_calendar.php
index 834c88b..79268f6 100644
--- a/src/controller/ajax_calendar.php
+++ b/src/controller/ajax_calendar.php
@@ -46,22 +46,35 @@ elseif(isset($_SESSION['admin']) && $_SESSION['admin'] === true
         $json = json_decode($data, true);
         
         if($_GET['action'] === 'new_event'){
-        $event = new Event($json['title'], $json['start'], $json['end'], $json['allDay'], $json["description"], $json['color']);
-        
+        try{
+            $event = new Event($json);
+        }
+        catch(InvalidArgumentException $e){
+            echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+            http_response_code(400);
+            die;
+        }
         $entityManager->persist($event);
         $entityManager->flush();
                 
                 echo json_encode(['success' => true, 'id' => $event->getId()]);
         }
         elseif($_GET['action'] === 'update_event'){
-        $event = $entityManager->find('App\Entity\Event', $json['id']);
-        $event->updateFromJSON($json);
+        $event = $entityManager->find('App\Entity\Event', (int)$json['id']);
+        try{
+            $event->securedUpdateFromJSON($json);
+        }
+        catch(InvalidArgumentException $e){
+            echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+            http_response_code(400);
+            die;
+        }
         $entityManager->flush();
 
                 echo json_encode(['success' => true]);
         }
         elseif($_GET['action'] === 'remove_event'){
-        $event = $entityManager->find('App\Entity\Event', $json['id']);
+        $event = $entityManager->find('App\Entity\Event', (int)$json['id']);
         $entityManager->remove($event);
         $entityManager->flush();
 
diff --git a/src/model/entities/Event.php b/src/model/entities/Event.php
index c85832f..ae0d396 100644
--- a/src/model/entities/Event.php
+++ b/src/model/entities/Event.php
@@ -39,23 +39,27 @@ class Event
     #[ORM\Column(type: 'string', length: 7, nullable: true)]

     private ?string $color = null;

 

-    public function __construct(string $title, string|\DateTimeInterface $start, string|\DateTimeInterface $end, bool $all_day, string $description = '', string $color = null){

-        $this->title = $title;

-        $this->description = $description;

-        $this->start = gettype($start) === 'string' ? new \DateTime($start) : $start;

-        $this->end = gettype($end) === 'string' ? new \DateTime($end) : $end;

-        $this->all_day = $all_day;

-        $this->color = $color;

+    public function __construct(array $json){

+        $this->securedUpdateFromJSON($json);

     }

 

-    public function updateFromJSON(array $json): void

+    public function securedUpdateFromJSON(array $json): void

     {

-        $this->title = $json['title'];

-        $this->description = $json['description'];

-        $this->start = new \DateTime($json['start']);

-        $this->end = new \DateTime($json['end']);

-        $this->all_day = $json['allDay'];

-        $this->color = $json['color'];

+        $this->title = htmlspecialchars($json['title']);

+        $this->description = htmlspecialchars($json['description']);

+        try{

+            $this->start = new \Datetime($json['start']);

+            $this->end = new \Datetime($json['end']);

+        }

+        catch(\Exception $e){

+            throw new \InvalidArgumentException('Bad date input');

+        }

+        $all_day = filter_var($json['allDay'] ?? null, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);

+        if(!is_bool($all_day)){

+            throw new \InvalidArgumentException('Bad checkbox input');

+        }

+        $this->all_day = $all_day;

+        $this->color = isset($json['color']) ? htmlspecialchars($json['color']) : null;

     }

 

     public function getId(): int