Avoid XSS in pagination ordering

2019-01-30 22:05:43 -08:00 · 2019-01-30 22:05:43 -08:00 · 83deec2e36
parent 8cf8f9ef07
commit 83deec2e36
1 changed files with 8 additions and 2 deletions
--- a/app/Core/Paginator.php
+++ b/app/Core/Paginator.php
@ -169,10 +169,16 @@ class Paginator
    public function executeQuery()
    {
        if ($this->query !== null) {
+
            $this->query
                ->offset($this->offset)
-                ->limit($this->limit)
-                ->orderBy($this->order, $this->direction);
+                ->limit($this->limit);
+
+            if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {
+                $this->query->orderBy($this->order, $this->direction);
+            } else {
+                $this->order = '';
+            }

            if ($this->formatter !== null) {
                return $this->formatter->withQuery($this->query)->format();