diff --git a/airtime_mvc/application/Bootstrap.php b/airtime_mvc/application/Bootstrap.php index 988e5ee4a..cd9d06905 100644 --- a/airtime_mvc/application/Bootstrap.php +++ b/airtime_mvc/application/Bootstrap.php @@ -18,6 +18,7 @@ require_once 'Preference.php'; require_once 'Locale.php'; require_once "DateHelper.php"; require_once "LocaleHelper.php"; +require_once "FileDataHelper.php"; require_once "HTTPHelper.php"; require_once "OsPath.php"; require_once "Database.php"; diff --git a/airtime_mvc/application/common/FileDataHelper.php b/airtime_mvc/application/common/FileDataHelper.php new file mode 100644 index 000000000..4f8738b05 --- /dev/null +++ b/airtime_mvc/application/common/FileDataHelper.php @@ -0,0 +1,20 @@ +id)) { - $objInfo = Application_Model_Library::getObjInfo($obj_sess->type); - $objInfo = Application_Model_Library::getObjInfo($obj_sess->type); $obj = new $objInfo['className']($obj_sess->id); $userInfo = Zend_Auth::getInstance()->getStorage()->read(); @@ -447,6 +445,8 @@ class LibraryController extends Zend_Controller_Action } if ($form->isValid($serialized)) { + // Sanitize any incorrect metadata that slipped past validation + FileDataHelper::sanitizeData($serialized["track_number"]); $formValues = $this->_getParam('data', null); $formdata = array(); diff --git a/airtime_mvc/application/modules/rest/controllers/MediaController.php b/airtime_mvc/application/modules/rest/controllers/MediaController.php index 2f4521b20..2b60b76a7 100644 --- a/airtime_mvc/application/modules/rest/controllers/MediaController.php +++ b/airtime_mvc/application/modules/rest/controllers/MediaController.php @@ -120,7 +120,8 @@ class Rest_MediaController extends Zend_Rest_Controller return; } else { // Sanitize any incorrect metadata that slipped past validation - $this->sanitizeData($file, $whiteList); + FileDataHelper::sanitizeData($whiteList["track_number"]); + /* If full_path is set, the post request came from ftp. * Users are allowed to upload folders via ftp. If this is the case * we need to include the folder name with the file name, otherwise @@ -174,6 +175,9 @@ class Rest_MediaController extends Zend_Rest_Controller $file->save(); return; } else if ($file && isset($requestData["resource_id"])) { + // Sanitize any incorrect metadata that slipped past validation + FileDataHelper::sanitizeData($whiteList["track_number"]); + $file->fromArray($whiteList, BasePeer::TYPE_FIELDNAME); //store the original filename @@ -305,7 +309,7 @@ class Rest_MediaController extends Zend_Rest_Controller $fileForm = new Application_Form_EditAudioMD(); $fileForm->startForm($file->getDbId()); $fileForm->populate($whiteList); - + /* * Here we are truncating metadata of any characters greater than the * max string length set in the database. In the rare case a track's @@ -340,18 +344,6 @@ class Rest_MediaController extends Zend_Rest_Controller return true; } - /** - * We want to throw out invalid data and process the upload successfully - * at all costs, so check the whitelisted data and sanitize it if necessary - * @param CcFiles $file CcFiles object being uploaded - * @param array $whitelist array of whitelisted (modifiable) file fields - */ - private function sanitizeData($file, &$whitelist) { - if (!ctype_digit(strval($whitelist["track_number"]))) { - $file->setDbTrackNumber(null); - } - } - private function processUploadedFile($callbackUrl, $originalFilename, $ownerId) { $CC_CONFIG = Config::getConfig();