Merge pull request #9607 from yashodha/update-year

[civicrm-core.git] / CRM / Core / Page / AJAX.php

diff --git a/CRM/Core/Page/AJAX.php b/CRM/Core/Page/AJAX.php
index 9777e8f5d177a2bc5ac103e347f12b59374e7ba7..8d6add8e283105d8cfedc8199769e9e88d1ecfc0 100644 (file)
--- a/CRM/Core/Page/AJAX.php
+++ b/CRM/Core/Page/AJAX.php
@@ -3,7 +3,7 @@
  +--------------------------------------------------------------------+
  | CiviCRM version 4.7                                                |
  +--------------------------------------------------------------------+
- | Copyright CiviCRM LLC (c) 2004-2016                                |
+ | Copyright CiviCRM LLC (c) 2004-2017                                |
  +--------------------------------------------------------------------+
  | This file is a part of CiviCRM.                                    |
  |                                                                    |
@@ -28,7 +28,7 @@
 /**
  *
  * @package CRM
- * @copyright CiviCRM LLC (c) 2004-2016
+ * @copyright CiviCRM LLC (c) 2004-2017
  * $Id$
  *
  */
@@ -215,27 +215,52 @@ class CRM_Core_Page_AJAX {
   }
 
   public static function defaultSortAndPagerParams($defaultOffset = 0, $defaultRowCount = 25, $defaultSort = NULL, $defaultsortOrder = 'asc') {
-    $params = array();
+    $params = array(
+      '_raw_values' => array(),
+    );
 
     $sortMapper = array();
-    foreach ($_GET['columns'] as $key => $value) {
-      $sortMapper[$key] = CRM_Utils_Type::escape($value['data'], 'MysqlColumnName');
-    };
+    if (isset($_GET['columns'])) {
+      foreach ($_GET['columns'] as $key => $value) {
+        $sortMapper[$key] = CRM_Utils_Type::validate($value['data'], 'MysqlColumnNameOrAlias');
+      };
+    }
 
-    $offset = isset($_GET['start']) ? CRM_Utils_Type::escape($_GET['start'], 'Integer') : $defaultOffset;
-    $rowCount = isset($_GET['length']) ? CRM_Utils_Type::escape($_GET['length'], 'Integer') : $defaultRowCount;
+    $offset = isset($_GET['start']) ? CRM_Utils_Type::validate($_GET['start'], 'Integer') : $defaultOffset;
+    $rowCount = isset($_GET['length']) ? CRM_Utils_Type::validate($_GET['length'], 'Integer') : $defaultRowCount;
     // Why is the number of order by columns limited to 1?
-    $sort = isset($_GET['order'][0]['column']) ? CRM_Utils_Array::value(CRM_Utils_Type::escape($_GET['order'][0]['column'], 'Integer'), $sortMapper) : $defaultSort;
-    $sortOrder = isset($_GET['order'][0]['dir']) ? CRM_Utils_Type::escape($_GET['order'][0]['dir'], 'MysqlOrderByDirection') : $defaultsortOrder;
+    $sort = isset($_GET['order'][0]['column']) ? CRM_Utils_Array::value(CRM_Utils_Type::validate($_GET['order'][0]['column'], 'Integer'), $sortMapper) : $defaultSort;
+    $sortOrder = isset($_GET['order'][0]['dir']) ? CRM_Utils_Type::validate($_GET['order'][0]['dir'], 'MysqlOrderByDirection') : $defaultsortOrder;
 
     if ($sort) {
-      $params['sortBy'] = "`{$sort}` {$sortOrder}";
+      $params['sortBy'] = "{$sort} {$sortOrder}";
+
+      $params['_raw_values']['sort'][0] = $sort;
+      $params['_raw_values']['order'][0] = $sortOrder;
     }
 
-    $params['page'] = ($offset / $rowCount) + 1;
+    $params['offset'] = $offset;
     $params['rp'] = $rowCount;
+    $params['page'] = ($offset / $rowCount) + 1;
 
     return $params;
   }
 
+  public static function validateParams($requiredParams = array(), $optionalParams = array()) {
+    $params = array();
+
+    foreach ($requiredParams as $param => $type) {
+      $params[$param] = CRM_Utils_Type::validate(CRM_Utils_Array::value($param, $_GET), $type);
+    }
+
+    foreach ($optionalParams as $param => $type) {
+      if (CRM_Utils_Array::value($param, $_GET)) {
+        $params[$param] = CRM_Utils_Type::validate(CRM_Utils_Array::value($param, $_GET), $type);
+      }
+    }
+
+    return $params;
+
+  }
+
 }