Changeset 12990 for trunk/xmlrpc/BxDolXMLRPCMedia.php

Timestamp:

10/20/09 19:42:05 (3 years ago)

Author:

Alexander Trofimov

Message:

Ticket #1340

File:

• trunk/xmlrpc/BxDolXMLRPCMedia.php (modified) (7 diffs)

trunk/xmlrpc/BxDolXMLRPCMedia.php

@@ -9 +9 @@
         $iIdProfile = BxDolXMLRPCUtil::getIdByNickname ($sNick);
         if (!$iIdProfile || !($iId = BxDolXMLRPCUtil::checkLogin ($sUser, $sPwd)))
-            return new xmlrpcresp(new xmlrpcval(array('error' => new xmlrpcval(1,"int")), "struct"));
+            return new xmlrpcresp(new xmlrpcval(array('error' => new xmlrpcval(1,"int")), "struct"));        
 
         return BxDolXMLRPCMedia::_getFilesInCategory ('videos', $iIdProfile, $sCat, 'video', 'getToken', 'flash/modules/video/files/get_mobile.php?id=');
@@ -24 +24 @@
 
     function _getFilesInCategory ($sModuleName, $iIdProfile, $sCat, $sWidget = '', $sFuncToken = '', $sTokenUrl = '')
-    {     
-        if ($sWidget) {
+    {   
+        if ($sWidget && preg_match('/[a-zA-Z0-9]+/', $sWidget)) {
             $GLOBALS['sModule'] = $sWidget;
             require_once (BX_DIRECTORY_PATH_ROOT . "flash/modules/{$sWidget}/inc/header.inc.php");
-        }
-        
-        $a = BxDolService::call ($sModuleName, 'get_files_in_cat', array($iIdProfile, $sCat), 'Search');
+        } else {
+            $sWidget = '';
+        }
+
+        $sCat = process_db_input($sCat, BX_TAGS_NO_ACTION, BX_SLASHES_NO_ACTION);
+
+        $a = BxDolService::call ($sModuleName, 'get_files_in_cat', array((int)$iIdProfile, $sCat), 'Search');
         if (!$a)
             return new xmlrpcval (array(), "array");
@@ -79 +83 @@
     function _getMediaCategories ($sType, $iIdProfile)
     {
+        $iIdProfile = (int)$iIdProfile;
         switch ($sType) {
             case 'photo':
@@ -158 +163 @@
         }
         bx_import('BxDolAlbums');
-        $o = new BxDolAlbums ($sType, $iIdProfile);
-        $aList = $o->getAlbumList (array('owner' => $iIdProfile));
+        $o = new BxDolAlbums ($sType, (int)$iIdProfile);
+        $aList = $o->getAlbumList (array('owner' => (int)$iIdProfile));
         $aXmlRpc = array ();
         foreach ($aList as $r)
@@ -195 +200 @@
     function _getFilesInAlbum ($sModuleName, $iIdProfile, $iAlbumId, $sWidget = '', $sFuncToken = '', $sTokenUrl = '')
     {     
-        if ($sWidget) {
+        if ($sWidget && preg_match('/[a-zA-Z0-9]+/', $sWidget)) {
             require_once (BX_DIRECTORY_PATH_ROOT . "flash/modules/global/inc/db.inc.php");
             require_once (BX_DIRECTORY_PATH_ROOT . "flash/modules/{$sWidget}/inc/header.inc.php");
@@ -202 +207 @@
         }
 
-        $a = BxDolService::call ($sModuleName, 'get_files_in_album', array($iAlbumId), 'Search');
+        $a = BxDolService::call ($sModuleName, 'get_files_in_album', array((int)$iAlbumId), 'Search');
         if (!$a)
             return new xmlrpcval (array(), "array");
@@ -227 +232 @@
         }
         return new xmlrpcval ($aFiles, "array");
-    }    
+    }
 }