skobkin/point-tools
1
1
Fork 0
Code Issues 4 Pull requests 1 Releases Activity

Fixing @ in POST parameters which could cause sending file from filesystem as POST data.

Browse source
This commit is contained in:
Alexey Skobkin 2017-01-06 00:13:50 +03:00
parent d9082a3a71
commit b712307782
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/Skobkin/Bundle/PointToolsBundle/Service/AbstractApi.php
View file

@ -79,6 +79,11 @@ class AbstractApi
*/ */
public function sendPostRequest($path, array $parameters = []) public function sendPostRequest($path, array $parameters = [])
{ {
// Cleaning POST parameters from potential @file injections
array_walk($parameters, function (string &$value, string $key) {
str_replace('@', '', $value);
});
/** @var GuzzleRequest $request */ /** @var GuzzleRequest $request */
$request = $this->client->post($path, null, $parameters); $request = $this->client->post($path, null, $parameters);