From edc80cda6bfef2572d515c4c139d83f7556e632a Mon Sep 17 00:00:00 2001 From: Sean Madsen Date: Sun, 22 Apr 2018 17:50:47 -0400 Subject: [PATCH] security/core#14 Validate "context" inputs When "context" is passed as a GET parameter, ensure that its values is a valid "Alphanumeric" type. This helps prevent XSS when the "context" value finds its way into templates that lack HTML output encoding. Replace... CRM_Utils_Request::retrieve\((['"])context\1,(\s*)(['"])String\3 ...with... CRM_Utils_Request::retrieve\($1context$1,$3Alphanumeric$3 Also search for the following and manually fix: \$_GET\[(['"])context\1\] \$_POST\[(['"])context\1\] \$_REQUEST\[(['"])context\1\] --- CRM/Activity/Form/Activity.php | 2 +- CRM/Activity/Form/ActivityView.php | 2 +- CRM/Activity/Form/Search.php | 2 +- CRM/Activity/Page/Tab.php | 4 ++-- CRM/Batch/Page/AJAX.php | 2 +- CRM/Campaign/Form/Campaign.php | 2 +- CRM/Campaign/Form/Petition.php | 2 +- CRM/Campaign/Form/Search.php | 2 +- CRM/Campaign/Form/Survey/Main.php | 2 +- CRM/Case/Form/Activity.php | 2 +- CRM/Case/Form/Activity/OpenCase.php | 2 +- CRM/Case/Form/CaseView.php | 2 +- CRM/Case/Form/EditClient.php | 2 +- CRM/Case/Form/Search.php | 2 +- CRM/Case/Page/CaseDetails.php | 2 +- CRM/Case/Page/Tab.php | 4 ++-- CRM/Contact/Form/Contact.php | 4 ++-- CRM/Contact/Form/GroupContact.php | 2 +- CRM/Contact/Form/Search.php | 2 +- CRM/Contact/Form/Task/Delete.php | 4 ++-- CRM/Contact/Form/Task/Email.php | 2 +- CRM/Contact/Form/Task/Map.php | 2 +- CRM/Contact/Form/Task/SMS.php | 2 +- CRM/Contact/Page/AJAX.php | 8 ++++---- CRM/Contact/Page/DedupeFind.php | 2 +- CRM/Contact/Page/DedupeRules.php | 2 +- CRM/Contact/Page/View/Relationship.php | 2 +- CRM/Contribute/BAO/ContributionRecur.php | 2 +- CRM/Contribute/Form/Contribution.php | 2 +- CRM/Contribute/Form/ContributionView.php | 2 +- CRM/Contribute/Form/Search.php | 2 +- CRM/Contribute/Page/PaymentInfo.php | 2 +- CRM/Contribute/Page/Tab.php | 4 ++-- CRM/Core/Page/AJAX.php | 5 ++--- CRM/Dashlet/Page/Activity.php | 2 +- CRM/Dashlet/Page/AllCases.php | 2 +- CRM/Dashlet/Page/GettingStarted.php | 2 +- CRM/Dashlet/Page/MyCases.php | 2 +- CRM/Event/Form/Participant.php | 2 +- CRM/Event/Form/Search.php | 2 +- CRM/Event/Form/Task/Badge.php | 2 +- CRM/Event/Page/EventInfo.php | 2 +- CRM/Event/Page/Tab.php | 2 +- CRM/Financial/Form/FinancialBatch.php | 2 +- CRM/Financial/Page/AJAX.php | 2 +- CRM/Financial/Page/FinancialBatch.php | 2 +- CRM/Grant/Form/Grant.php | 2 +- CRM/Grant/Form/GrantView.php | 2 +- CRM/Grant/Form/Search.php | 2 +- CRM/Grant/Page/Tab.php | 4 ++-- CRM/Mailing/Page/Event.php | 2 +- CRM/Mailing/Page/Report.php | 2 +- CRM/Member/Form.php | 2 +- CRM/Member/Form/MembershipView.php | 2 +- CRM/Member/Form/Search.php | 2 +- CRM/Member/Page/Tab.php | 4 ++-- CRM/PCP/Form/Campaign.php | 2 +- CRM/PCP/Form/PCP.php | 2 +- CRM/Pledge/Form/Pledge.php | 2 +- CRM/Pledge/Form/Search.php | 2 +- CRM/Pledge/Page/Payment.php | 2 +- CRM/Pledge/Page/Tab.php | 4 ++-- CRM/Price/Page/Set.php | 2 +- CRM/Profile/Form.php | 2 +- CRM/Profile/Form/Edit.php | 2 +- CRM/Report/Form/Activity.php | 2 +- CRM/UF/Page/Group.php | 2 +- 67 files changed, 79 insertions(+), 80 deletions(-) diff --git a/CRM/Activity/Form/Activity.php b/CRM/Activity/Form/Activity.php index a82cbade69..5f78cbd9f1 100644 --- a/CRM/Activity/Form/Activity.php +++ b/CRM/Activity/Form/Activity.php @@ -255,7 +255,7 @@ class CRM_Activity_Form_Activity extends CRM_Contact_Form_Task { // Give the context. if (!isset($this->_context)) { - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if (CRM_Contact_Form_Search::isSearchContext($this->_context)) { $this->_context = 'search'; } diff --git a/CRM/Activity/Form/ActivityView.php b/CRM/Activity/Form/ActivityView.php index 1adf70a582..2c11dd4ff3 100644 --- a/CRM/Activity/Form/ActivityView.php +++ b/CRM/Activity/Form/ActivityView.php @@ -42,7 +42,7 @@ class CRM_Activity_Form_ActivityView extends CRM_Core_Form { public function preProcess() { // Get the activity values. $activityId = CRM_Utils_Request::retrieve('id', 'Positive', $this); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this); // Check for required permissions, CRM-6264. diff --git a/CRM/Activity/Form/Search.php b/CRM/Activity/Form/Search.php index 9e3ffd5960..7e682b50fe 100644 --- a/CRM/Activity/Form/Search.php +++ b/CRM/Activity/Form/Search.php @@ -87,7 +87,7 @@ class CRM_Activity_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign("context", $this->_context); diff --git a/CRM/Activity/Page/Tab.php b/CRM/Activity/Page/Tab.php index 658a350b19..8a4cd70d4e 100644 --- a/CRM/Activity/Page/Tab.php +++ b/CRM/Activity/Page/Tab.php @@ -63,7 +63,7 @@ class CRM_Activity_Page_Tab extends CRM_Core_Page { */ public function edit() { // used for ajax tabs - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $context); $this->_id = CRM_Utils_Request::retrieve('id', 'Integer', $this); @@ -159,7 +159,7 @@ class CRM_Activity_Page_Tab extends CRM_Core_Page { * Perform actions and display for activities. */ public function run() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $contactId = CRM_Utils_Request::retrieve('cid', 'Positive', $this); $action = CRM_Utils_Request::retrieve('action', 'String', $this); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); diff --git a/CRM/Batch/Page/AJAX.php b/CRM/Batch/Page/AJAX.php index b06cd75450..7849fc7e71 100644 --- a/CRM/Batch/Page/AJAX.php +++ b/CRM/Batch/Page/AJAX.php @@ -54,7 +54,7 @@ class CRM_Batch_Page_AJAX { * @deprecated */ public static function getBatchList() { - $context = isset($_REQUEST['context']) ? CRM_Utils_Type::escape($_REQUEST['context'], 'String') : NULL; + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); if ($context != 'financialBatch') { $sortMapper = array( 0 => 'title', diff --git a/CRM/Campaign/Form/Campaign.php b/CRM/Campaign/Form/Campaign.php index 916d2dcbbe..dabd71abed 100644 --- a/CRM/Campaign/Form/Campaign.php +++ b/CRM/Campaign/Form/Campaign.php @@ -76,7 +76,7 @@ class CRM_Campaign_Form_Campaign extends CRM_Core_Form { CRM_Utils_System::permissionDenied(); } - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); diff --git a/CRM/Campaign/Form/Petition.php b/CRM/Campaign/Form/Petition.php index 9ebc4725a0..0022218e4c 100644 --- a/CRM/Campaign/Form/Petition.php +++ b/CRM/Campaign/Form/Petition.php @@ -47,7 +47,7 @@ class CRM_Campaign_Form_Petition extends CRM_Core_Form { CRM_Utils_System::permissionDenied(); } - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); diff --git a/CRM/Campaign/Form/Search.php b/CRM/Campaign/Form/Search.php index 8c31f28e2e..70fd4e6e2e 100644 --- a/CRM/Campaign/Form/Search.php +++ b/CRM/Campaign/Form/Search.php @@ -81,7 +81,7 @@ class CRM_Campaign_Form_Search extends CRM_Core_Form_Search { //useful when we are being driven by the wizard framework $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); //operation for state machine. diff --git a/CRM/Campaign/Form/Survey/Main.php b/CRM/Campaign/Form/Survey/Main.php index 57974875e1..c8e4123051 100644 --- a/CRM/Campaign/Form/Survey/Main.php +++ b/CRM/Campaign/Form/Survey/Main.php @@ -60,7 +60,7 @@ class CRM_Campaign_Form_Survey_Main extends CRM_Campaign_Form_Survey { public function preProcess() { parent::preProcess(); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); diff --git a/CRM/Case/Form/Activity.php b/CRM/Case/Form/Activity.php index d39768a0aa..d12b8716cc 100644 --- a/CRM/Case/Form/Activity.php +++ b/CRM/Case/Form/Activity.php @@ -63,7 +63,7 @@ class CRM_Case_Form_Activity extends CRM_Activity_Form_Activity { public function preProcess() { $caseIds = CRM_Utils_Request::retrieve('caseid', 'String', $this); $this->_caseId = explode(',', $caseIds); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if (!$this->_context) { $this->_context = 'caseActivity'; } diff --git a/CRM/Case/Form/Activity/OpenCase.php b/CRM/Case/Form/Activity/OpenCase.php index fe1cecef3e..aa86804682 100644 --- a/CRM/Case/Form/Activity/OpenCase.php +++ b/CRM/Case/Form/Activity/OpenCase.php @@ -62,7 +62,7 @@ class CRM_Case_Form_Activity_OpenCase { return; } - $form->_context = CRM_Utils_Request::retrieve('context', 'String', $form); + $form->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $form); $form->_contactID = CRM_Utils_Request::retrieve('cid', 'Positive', $form); $form->assign('context', $form->_context); diff --git a/CRM/Case/Form/CaseView.php b/CRM/Case/Form/CaseView.php index 3b5ae3167d..ba7814ec0f 100644 --- a/CRM/Case/Form/CaseView.php +++ b/CRM/Case/Form/CaseView.php @@ -77,7 +77,7 @@ class CRM_Case_Form_CaseView extends CRM_Core_Form { CRM_Core_Error::fatal(ts('You are not authorized to access this page.')); } - $fulltext = CRM_Utils_Request::retrieve('context', 'String'); + $fulltext = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); if ($fulltext == 'fulltext') { $this->assign('fulltext', $fulltext); } diff --git a/CRM/Case/Form/EditClient.php b/CRM/Case/Form/EditClient.php index d0173e04b0..5259cf48f6 100644 --- a/CRM/Case/Form/EditClient.php +++ b/CRM/Case/Form/EditClient.php @@ -42,7 +42,7 @@ class CRM_Case_Form_EditClient extends CRM_Core_Form { public function preProcess() { $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this, TRUE); CRM_Utils_Request::retrieve('id', 'Positive', $this, TRUE); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); //get current client name. $this->assign('currentClientName', CRM_Contact_BAO_Contact::displayName($cid)); diff --git a/CRM/Case/Form/Search.php b/CRM/Case/Form/Search.php index 3ca0ed0169..86e3d4031d 100644 --- a/CRM/Case/Form/Search.php +++ b/CRM/Case/Form/Search.php @@ -97,7 +97,7 @@ class CRM_Case_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign('context', $this->_context); diff --git a/CRM/Case/Page/CaseDetails.php b/CRM/Case/Page/CaseDetails.php index bc8ef05969..fc5e4c5fc3 100644 --- a/CRM/Case/Page/CaseDetails.php +++ b/CRM/Case/Page/CaseDetails.php @@ -41,7 +41,7 @@ class CRM_Case_Page_CaseDetails extends CRM_Core_Page { */ public function run() { $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('action', $this->_action); $this->assign('context', $this->_context); diff --git a/CRM/Case/Page/Tab.php b/CRM/Case/Page/Tab.php index 52d84e8c76..650122db05 100644 --- a/CRM/Case/Page/Tab.php +++ b/CRM/Case/Page/Tab.php @@ -59,7 +59,7 @@ class CRM_Case_Page_Tab extends CRM_Core_Page { } $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if ($this->_contactId) { $this->assign('contactId', $this->_contactId); @@ -178,7 +178,7 @@ class CRM_Case_Page_Tab extends CRM_Core_Page { */ public function run() { $contactID = CRM_Utils_Request::retrieve('cid', 'Positive', CRM_Core_DAO::$_nullArray); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if ($context == 'standalone' && !$contactID) { $this->_action = CRM_Core_Action::ADD; diff --git a/CRM/Contact/Form/Contact.php b/CRM/Contact/Form/Contact.php index 4c23815e3c..1b985e131f 100644 --- a/CRM/Contact/Form/Contact.php +++ b/CRM/Contact/Form/Contact.php @@ -235,7 +235,7 @@ class CRM_Contact_Form_Contact extends CRM_Core_Form { // omitting contactImage from title for now since the summary overlay css doesn't work outside of our crm-container CRM_Utils_System::setTitle($displayName); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $qfKey = CRM_Utils_Request::retrieve('key', 'String', $this); $urlParams = 'reset=1&cid=' . $this->_contactId; @@ -1055,7 +1055,7 @@ class CRM_Contact_Form_Contact extends CRM_Core_Form { $session->replaceUserContext(CRM_Utils_System::url('civicrm/contact/add', $resetStr)); } else { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $qfKey = CRM_Utils_Request::retrieve('key', 'String', $this); //validate the qfKey $urlParams = 'reset=1&cid=' . $contact->id; diff --git a/CRM/Contact/Form/GroupContact.php b/CRM/Contact/Form/GroupContact.php index fcbc9fc681..c8114ec036 100644 --- a/CRM/Contact/Form/GroupContact.php +++ b/CRM/Contact/Form/GroupContact.php @@ -70,7 +70,7 @@ class CRM_Contact_Form_GroupContact extends CRM_Core_Form { public function preProcess() { $this->_contactId = $this->get('contactId'); $this->_groupContactId = $this->get('groupContactId'); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); } /** diff --git a/CRM/Contact/Form/Search.php b/CRM/Contact/Form/Search.php index e689bc8f2c..5b9a2079dd 100644 --- a/CRM/Contact/Form/Search.php +++ b/CRM/Contact/Form/Search.php @@ -555,7 +555,7 @@ class CRM_Contact_Form_Search extends CRM_Core_Form_Search { } // assign context to drive the template display, make sure context is valid - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); if (!CRM_Utils_Array::value($this->_context, self::validContext())) { $this->_context = 'search'; } diff --git a/CRM/Contact/Form/Task/Delete.php b/CRM/Contact/Form/Task/Delete.php index bc50f684da..a05322ab6b 100644 --- a/CRM/Contact/Form/Task/Delete.php +++ b/CRM/Contact/Form/Task/Delete.php @@ -150,7 +150,7 @@ class CRM_Contact_Form_Task_Delete extends CRM_Contact_Form_Task { if ($this->_single) { // also fix the user context stack in case the user hits cancel - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'basic'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'basic'); if ($context == 'search' && CRM_Utils_Rule::qfKey($this->_searchKey)) { $urlParams = "&context=$context&key=$this->_searchKey"; } @@ -200,7 +200,7 @@ class CRM_Contact_Form_Task_Delete extends CRM_Contact_Form_Task { $session = CRM_Core_Session::singleton(); $currentUserId = $session->get('userID'); - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'basic'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'basic'); $urlParams = 'force=1'; $urlString = "civicrm/contact/search/$context"; diff --git a/CRM/Contact/Form/Task/Email.php b/CRM/Contact/Form/Task/Email.php index a2b83de3a0..08556492b2 100644 --- a/CRM/Contact/Form/Task/Email.php +++ b/CRM/Contact/Form/Task/Email.php @@ -96,7 +96,7 @@ class CRM_Contact_Form_Task_Email extends CRM_Contact_Form_Task { public function preProcess() { // store case id if present $this->_caseId = CRM_Utils_Request::retrieve('caseid', 'String', $this, FALSE); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $cid = CRM_Utils_Request::retrieve('cid', 'String', $this, FALSE); diff --git a/CRM/Contact/Form/Task/Map.php b/CRM/Contact/Form/Task/Map.php index 5e21b5e95c..e02c83bef5 100644 --- a/CRM/Contact/Form/Task/Map.php +++ b/CRM/Contact/Form/Task/Map.php @@ -63,7 +63,7 @@ class CRM_Contact_Form_Task_Map extends CRM_Contact_Form_Task { $this, FALSE ); $this->assign('profileGID', $profileGID); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $type = 'Contact'; if ($cid) { diff --git a/CRM/Contact/Form/Task/SMS.php b/CRM/Contact/Form/Task/SMS.php index 6e5a1734da..730ae09432 100644 --- a/CRM/Contact/Form/Task/SMS.php +++ b/CRM/Contact/Form/Task/SMS.php @@ -53,7 +53,7 @@ class CRM_Contact_Form_Task_SMS extends CRM_Contact_Form_Task { public function preProcess() { - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this, FALSE); diff --git a/CRM/Contact/Page/AJAX.php b/CRM/Contact/Page/AJAX.php index af6fdae498..79fa957b6c 100644 --- a/CRM/Contact/Page/AJAX.php +++ b/CRM/Contact/Page/AJAX.php @@ -415,7 +415,7 @@ LIMIT {$offset}, {$rowCount} // send query to hook to be modified if needed CRM_Utils_Hook::contactListQuery($query, $name, - CRM_Utils_Request::retrieve('context', 'String'), + CRM_Utils_Request::retrieve('context', 'Alphanumeric'), CRM_Utils_Request::retrieve('cid', 'Positive') ); @@ -440,7 +440,7 @@ LIMIT {$offset}, {$rowCount} // send query to hook to be modified if needed CRM_Utils_Hook::contactListQuery($query, $name, - CRM_Utils_Request::retrieve('context', 'String'), + CRM_Utils_Request::retrieve('context', 'Alphanumeric'), CRM_Utils_Request::retrieve('cid', 'Positive') ); @@ -510,7 +510,7 @@ LIMIT {$offset}, {$rowCount} // send query to hook to be modified if needed CRM_Utils_Hook::contactListQuery($query, $name, - CRM_Utils_Request::retrieve('context', 'String'), + CRM_Utils_Request::retrieve('context', 'Alphanumeric'), CRM_Utils_Request::retrieve('cid', 'Positive') ); @@ -1050,7 +1050,7 @@ LIMIT {$offset}, {$rowCount} */ public static function getContactRelationships() { $contactID = CRM_Utils_Type::escape($_GET['cid'], 'Integer'); - $context = CRM_Utils_Type::escape($_GET['context'], 'String'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); $relationship_type_id = CRM_Utils_Type::escape(CRM_Utils_Array::value('relationship_type_id', $_GET), 'Integer', FALSE); if (!CRM_Contact_BAO_Contact_Permission::allow($contactID)) { diff --git a/CRM/Contact/Page/DedupeFind.php b/CRM/Contact/Page/DedupeFind.php index 9807cd3652..0bb43ace8e 100644 --- a/CRM/Contact/Page/DedupeFind.php +++ b/CRM/Contact/Page/DedupeFind.php @@ -84,7 +84,7 @@ class CRM_Contact_Page_DedupeFind extends CRM_Core_Page_Basic { $this->initialize(); $gid = CRM_Utils_Request::retrieve('gid', 'Positive', $this, FALSE, 0); $action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 0); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $limit = CRM_Utils_Request::retrieve('limit', 'Integer', $this); $rgid = CRM_Utils_Request::retrieve('rgid', 'Positive', $this); $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this, FALSE, 0); diff --git a/CRM/Contact/Page/DedupeRules.php b/CRM/Contact/Page/DedupeRules.php index ac21c9ce79..a54cda57fc 100644 --- a/CRM/Contact/Page/DedupeRules.php +++ b/CRM/Contact/Page/DedupeRules.php @@ -101,7 +101,7 @@ class CRM_Contact_Page_DedupeRules extends CRM_Core_Page_Basic { public function run() { $id = $this->getIdAndAction(); - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE); if ($context == 'nonDupe') { CRM_Core_Session::setStatus(ts('Selected contacts have been marked as not duplicates'), ts('Changes Saved'), 'success'); } diff --git a/CRM/Contact/Page/View/Relationship.php b/CRM/Contact/Page/View/Relationship.php index 6d96633f37..ec323a3dd2 100644 --- a/CRM/Contact/Page/View/Relationship.php +++ b/CRM/Contact/Page/View/Relationship.php @@ -217,7 +217,7 @@ class CRM_Contact_Page_View_Relationship extends CRM_Core_Page { } public function setContext() { - $context = CRM_Utils_Request::retrieve('context', 'String', + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search' ); diff --git a/CRM/Contribute/BAO/ContributionRecur.php b/CRM/Contribute/BAO/ContributionRecur.php index fd9d7538df..a5c76722c4 100644 --- a/CRM/Contribute/BAO/ContributionRecur.php +++ b/CRM/Contribute/BAO/ContributionRecur.php @@ -471,7 +471,7 @@ INNER JOIN civicrm_contribution con ON ( con.id = mp.contribution_id ) $cid = CRM_Utils_Request::retrieve('cid', 'Integer'); $mid = CRM_Utils_Request::retrieve('mid', 'Integer'); $qfkey = CRM_Utils_Request::retrieve('key', 'String'); - $context = CRM_Utils_Request::retrieve('context', 'String'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); if ($cid) { switch ($context) { case 'contribution': diff --git a/CRM/Contribute/Form/Contribution.php b/CRM/Contribute/Form/Contribution.php index b04867d691..61c40e4c1d 100644 --- a/CRM/Contribute/Form/Contribution.php +++ b/CRM/Contribute/Form/Contribution.php @@ -250,7 +250,7 @@ class CRM_Contribute_Form_Contribution extends CRM_Contribute_Form_AbstractEditP $this->assign('isUsePaymentBlock', TRUE); } - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); $this->_compId = CRM_Utils_Request::retrieve('compId', 'Positive', $this); diff --git a/CRM/Contribute/Form/ContributionView.php b/CRM/Contribute/Form/ContributionView.php index b70a1eabef..8d3f74f596 100644 --- a/CRM/Contribute/Form/ContributionView.php +++ b/CRM/Contribute/Form/ContributionView.php @@ -42,7 +42,7 @@ class CRM_Contribute_Form_ContributionView extends CRM_Core_Form { public function preProcess() { $id = $this->get('id'); $params = array('id' => $id); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $context); $values = CRM_Contribute_BAO_Contribution::getValuesWithMappings($params); diff --git a/CRM/Contribute/Form/Search.php b/CRM/Contribute/Form/Search.php index 7fa4f02bf0..035b9523e8 100644 --- a/CRM/Contribute/Form/Search.php +++ b/CRM/Contribute/Form/Search.php @@ -83,7 +83,7 @@ class CRM_Contribute_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign("context", $this->_context); diff --git a/CRM/Contribute/Page/PaymentInfo.php b/CRM/Contribute/Page/PaymentInfo.php index 7fb1b4d4e5..a808de23bd 100644 --- a/CRM/Contribute/Page/PaymentInfo.php +++ b/CRM/Contribute/Page/PaymentInfo.php @@ -35,7 +35,7 @@ class CRM_Contribute_Page_PaymentInfo extends CRM_Core_Page { $this->_component = CRM_Utils_Request::retrieve('component', 'String', $this, TRUE); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this, TRUE); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, TRUE); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, TRUE); $this->_cid = CRM_Utils_Request::retrieve('cid', 'String', $this, TRUE); $this->assign('cid', $this->_cid); diff --git a/CRM/Contribute/Page/Tab.php b/CRM/Contribute/Page/Tab.php index a2f1a578f8..5dabc4f2b8 100644 --- a/CRM/Contribute/Page/Tab.php +++ b/CRM/Contribute/Page/Tab.php @@ -313,7 +313,7 @@ class CRM_Contribute_Page_Tab extends CRM_Core_Page { } public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); @@ -371,7 +371,7 @@ class CRM_Contribute_Page_Tab extends CRM_Core_Page { public function setContext() { $qfKey = CRM_Utils_Request::retrieve('key', 'String', $this); - $context = CRM_Utils_Request::retrieve('context', 'String', + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search' ); $compContext = CRM_Utils_Request::retrieve('compContext', 'String', $this); diff --git a/CRM/Core/Page/AJAX.php b/CRM/Core/Page/AJAX.php index 941c53ff04..e0b2af2055 100644 --- a/CRM/Core/Page/AJAX.php +++ b/CRM/Core/Page/AJAX.php @@ -98,9 +98,8 @@ class CRM_Core_Page_AJAX { $id = CRM_Utils_Type::escape($_REQUEST['id'], 'Integer'); } - if (!empty($_REQUEST['context'])) { - $context = CRM_Utils_Type::escape($_REQUEST['context'], 'String'); - } + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); + // return false if $id is null and // $context is not civicrm_event or civicrm_contribution_page if (!$id || !in_array($context, array('civicrm_event', 'civicrm_contribution_page'))) { diff --git a/CRM/Dashlet/Page/Activity.php b/CRM/Dashlet/Page/Activity.php index aa0dcea312..b8a8d839eb 100644 --- a/CRM/Dashlet/Page/Activity.php +++ b/CRM/Dashlet/Page/Activity.php @@ -50,7 +50,7 @@ class CRM_Dashlet_Page_Activity extends CRM_Core_Page { $this->assign('contactID', $contactID); $this->assign('contactId', $contactID); - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'dashlet'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'dashlet'); $this->assign('context', $context); // a user can always view their own activity diff --git a/CRM/Dashlet/Page/AllCases.php b/CRM/Dashlet/Page/AllCases.php index 80331e77b2..8ac619a4bc 100644 --- a/CRM/Dashlet/Page/AllCases.php +++ b/CRM/Dashlet/Page/AllCases.php @@ -45,7 +45,7 @@ class CRM_Dashlet_Page_AllCases extends CRM_Core_Page { * @return void */ public function run() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'dashlet'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'dashlet'); $this->assign('context', $context); //check for civicase access. diff --git a/CRM/Dashlet/Page/GettingStarted.php b/CRM/Dashlet/Page/GettingStarted.php index 6e51881791..cb77b45cff 100644 --- a/CRM/Dashlet/Page/GettingStarted.php +++ b/CRM/Dashlet/Page/GettingStarted.php @@ -70,7 +70,7 @@ class CRM_Dashlet_Page_GettingStarted extends CRM_Core_Page { * List gettingStarted page as dashlet. */ public function run() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'dashlet'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'dashlet'); // Assign smarty variables. $this->assign('context', $context); diff --git a/CRM/Dashlet/Page/MyCases.php b/CRM/Dashlet/Page/MyCases.php index 057c09ec9f..62f618b540 100644 --- a/CRM/Dashlet/Page/MyCases.php +++ b/CRM/Dashlet/Page/MyCases.php @@ -45,7 +45,7 @@ class CRM_Dashlet_Page_MyCases extends CRM_Core_Page { * @return void */ public function run() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'dashlet'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'dashlet'); $this->assign('context', $context); //check for civicase access. diff --git a/CRM/Event/Form/Participant.php b/CRM/Event/Form/Participant.php index bb16370b55..5897aff52b 100644 --- a/CRM/Event/Form/Participant.php +++ b/CRM/Event/Form/Participant.php @@ -223,7 +223,7 @@ class CRM_Event_Form_Participant extends CRM_Contribute_Form_AbstractEditPayment // @todo eliminate this duplication. $this->_contactId = $this->_contactID; $this->_eID = CRM_Utils_Request::retrieve('eid', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); if ($this->_contactID) { diff --git a/CRM/Event/Form/Search.php b/CRM/Event/Form/Search.php index f2f4313b57..c5b73d8140 100644 --- a/CRM/Event/Form/Search.php +++ b/CRM/Event/Form/Search.php @@ -97,7 +97,7 @@ class CRM_Event_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->_ssID = CRM_Utils_Request::retrieve('ssID', 'Positive', $this); $this->assign("context", $this->_context); diff --git a/CRM/Event/Form/Task/Badge.php b/CRM/Event/Form/Task/Badge.php index b9ba3977c5..11ab8cd151 100644 --- a/CRM/Event/Form/Task/Badge.php +++ b/CRM/Event/Form/Task/Badge.php @@ -57,7 +57,7 @@ class CRM_Event_Form_Task_Badge extends CRM_Event_Form_Task { * @return void */ public function preProcess() { - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if ($this->_context == 'view') { $this->_single = TRUE; diff --git a/CRM/Event/Page/EventInfo.php b/CRM/Event/Page/EventInfo.php index 905c978160..7b088ea3b8 100644 --- a/CRM/Event/Page/EventInfo.php +++ b/CRM/Event/Page/EventInfo.php @@ -59,7 +59,7 @@ class CRM_Event_Page_EventInfo extends CRM_Core_Page { } $action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE); - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'register'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'register'); $this->assign('context', $context); // Sometimes we want to suppress the Event Full msg diff --git a/CRM/Event/Page/Tab.php b/CRM/Event/Page/Tab.php index 43c898fa9e..d2ffcb183b 100644 --- a/CRM/Event/Page/Tab.php +++ b/CRM/Event/Page/Tab.php @@ -119,7 +119,7 @@ class CRM_Event_Page_Tab extends CRM_Core_Page { } public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); diff --git a/CRM/Financial/Form/FinancialBatch.php b/CRM/Financial/Form/FinancialBatch.php index 9f3bd5e6d4..4a9264c88a 100644 --- a/CRM/Financial/Form/FinancialBatch.php +++ b/CRM/Financial/Form/FinancialBatch.php @@ -47,7 +47,7 @@ class CRM_Financial_Form_FinancialBatch extends CRM_Contribute_Form { * Set variables up before form is built. */ public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->set("context", $context); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); parent::preProcess(); diff --git a/CRM/Financial/Page/AJAX.php b/CRM/Financial/Page/AJAX.php index fe43978b03..c5a51b5f99 100644 --- a/CRM/Financial/Page/AJAX.php +++ b/CRM/Financial/Page/AJAX.php @@ -267,7 +267,7 @@ class CRM_Financial_Page_AJAX { $rowCount = isset($_REQUEST['iDisplayLength']) ? CRM_Utils_Type::escape($_REQUEST['iDisplayLength'], 'Integer') : 25; $sort = isset($_REQUEST['iSortCol_0']) ? CRM_Utils_Array::value(CRM_Utils_Type::escape($_REQUEST['iSortCol_0'], 'Integer'), $sortMapper) : NULL; $sortOrder = isset($_REQUEST['sSortDir_0']) ? CRM_Utils_Type::escape($_REQUEST['sSortDir_0'], 'String') : 'asc'; - $context = isset($_REQUEST['context']) ? CRM_Utils_Type::escape($_REQUEST['context'], 'String') : NULL; + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric'); $entityID = isset($_REQUEST['entityID']) ? CRM_Utils_Type::escape($_REQUEST['entityID'], 'String') : NULL; $notPresent = isset($_REQUEST['notPresent']) ? CRM_Utils_Type::escape($_REQUEST['notPresent'], 'String') : NULL; $statusID = isset($_REQUEST['statusID']) ? CRM_Utils_Type::escape($_REQUEST['statusID'], 'String') : NULL; diff --git a/CRM/Financial/Page/FinancialBatch.php b/CRM/Financial/Page/FinancialBatch.php index 27a7783aea..21a4db3075 100644 --- a/CRM/Financial/Page/FinancialBatch.php +++ b/CRM/Financial/Page/FinancialBatch.php @@ -74,7 +74,7 @@ class CRM_Financial_Page_FinancialBatch extends CRM_Core_Page_Basic { * Finally it calls the parent's run method. */ public function run() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->set("context", $context); $id = $this->getIdAndAction(); diff --git a/CRM/Grant/Form/Grant.php b/CRM/Grant/Form/Grant.php index 1c1fb8fd15..0a56a04933 100644 --- a/CRM/Grant/Form/Grant.php +++ b/CRM/Grant/Form/Grant.php @@ -75,7 +75,7 @@ class CRM_Grant_Form_Grant extends CRM_Core_Form { if ($this->_id) { $this->_grantType = CRM_Core_DAO::getFieldValue('CRM_Grant_DAO_Grant', $this->_id, 'grant_type_id'); } - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('action', $this->_action); $this->assign('context', $this->_context); diff --git a/CRM/Grant/Form/GrantView.php b/CRM/Grant/Form/GrantView.php index d563406317..7c48ba57be 100644 --- a/CRM/Grant/Form/GrantView.php +++ b/CRM/Grant/Form/GrantView.php @@ -47,7 +47,7 @@ class CRM_Grant_Form_GrantView extends CRM_Core_Form { public function preProcess() { $this->_contactID = CRM_Utils_Request::retrieve('cid', 'Positive', $this); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $context); $values = array(); diff --git a/CRM/Grant/Form/Search.php b/CRM/Grant/Form/Search.php index e75c63469b..12e6ea09a1 100644 --- a/CRM/Grant/Form/Search.php +++ b/CRM/Grant/Form/Search.php @@ -91,7 +91,7 @@ class CRM_Grant_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign("context", $this->_context); diff --git a/CRM/Grant/Page/Tab.php b/CRM/Grant/Page/Tab.php index 3f121d138c..39e14ee7ba 100644 --- a/CRM/Grant/Page/Tab.php +++ b/CRM/Grant/Page/Tab.php @@ -102,7 +102,7 @@ class CRM_Grant_Page_Tab extends CRM_Contact_Page_View { * @return void */ public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); @@ -151,7 +151,7 @@ class CRM_Grant_Page_Tab extends CRM_Contact_Page_View { } public function setContext() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_id = CRM_Utils_Request::retrieve('id', 'Integer', $this); $session = CRM_Core_Session::singleton(); diff --git a/CRM/Mailing/Page/Event.php b/CRM/Mailing/Page/Event.php index 90aef4ec1e..c0db83a0ed 100644 --- a/CRM/Mailing/Page/Event.php +++ b/CRM/Mailing/Page/Event.php @@ -63,7 +63,7 @@ class CRM_Mailing_Page_Event extends CRM_Core_Page { // check that the user has permission to access mailing id CRM_Mailing_BAO_Mailing::checkPermission($mailing_id); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if ($context == 'activitySelector') { $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this); diff --git a/CRM/Mailing/Page/Report.php b/CRM/Mailing/Page/Report.php index 6d36ee08f4..3652f97781 100644 --- a/CRM/Mailing/Page/Report.php +++ b/CRM/Mailing/Page/Report.php @@ -110,7 +110,7 @@ class CRM_Mailing_Page_Report extends CRM_Core_Page_Basic { CRM_Mailing_BAO_Mailing::getMailingContent($report, $this); // assign backurl - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $cid = CRM_Utils_Request::retrieve('cid', 'Positive', $this); if ($context == 'activitySelector') { diff --git a/CRM/Member/Form.php b/CRM/Member/Form.php index 39997389e4..5485ed8873 100644 --- a/CRM/Member/Form.php +++ b/CRM/Member/Form.php @@ -110,7 +110,7 @@ class CRM_Member_Form extends CRM_Contribute_Form_AbstractEditPayment { parent::preProcess(); $params = array(); - $params['context'] = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'membership'); + $params['context'] = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'membership'); $params['id'] = CRM_Utils_Request::retrieve('id', 'Positive', $this); $params['mode'] = CRM_Utils_Request::retrieve('mode', 'String', $this); diff --git a/CRM/Member/Form/MembershipView.php b/CRM/Member/Form/MembershipView.php index 9d656c52dd..9e3d9784db 100644 --- a/CRM/Member/Form/MembershipView.php +++ b/CRM/Member/Form/MembershipView.php @@ -166,7 +166,7 @@ class CRM_Member_Form_MembershipView extends CRM_Core_Form { $this->contactID = CRM_Utils_Request::retrieve('cid', 'Positive', $this); // Make sure context is assigned to template for condition where we come here view civicrm/membership/view - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $context); if ($this->membershipID) { diff --git a/CRM/Member/Form/Search.php b/CRM/Member/Form/Search.php index 39f338d411..8d26304f3b 100644 --- a/CRM/Member/Form/Search.php +++ b/CRM/Member/Form/Search.php @@ -92,7 +92,7 @@ class CRM_Member_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign("context", $this->_context); diff --git a/CRM/Member/Page/Tab.php b/CRM/Member/Page/Tab.php index 17c778bb21..d54e4f5715 100644 --- a/CRM/Member/Page/Tab.php +++ b/CRM/Member/Page/Tab.php @@ -306,7 +306,7 @@ class CRM_Member_Page_Tab extends CRM_Core_Page { } public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); @@ -390,7 +390,7 @@ class CRM_Member_Page_Tab extends CRM_Core_Page { * @param int $contactId */ public static function setContext(&$form, $contactId = NULL) { - $context = CRM_Utils_Request::retrieve('context', 'String', $form, FALSE, 'search'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $form, FALSE, 'search'); $qfKey = CRM_Utils_Request::retrieve('key', 'String', $form); diff --git a/CRM/PCP/Form/Campaign.php b/CRM/PCP/Form/Campaign.php index 2618f6193d..4bc49e9424 100644 --- a/CRM/PCP/Form/Campaign.php +++ b/CRM/PCP/Form/Campaign.php @@ -50,7 +50,7 @@ class CRM_PCP_Form_Campaign extends CRM_Core_Form { $this->_component = CRM_Utils_Request::retrieve('component', 'String', $this); $this->assign('component', $this->_component); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('context', $this->_context); $this->_pageId = CRM_Utils_Request::retrieve('id', 'Positive', $this, FALSE); diff --git a/CRM/PCP/Form/PCP.php b/CRM/PCP/Form/PCP.php index 187949ee82..41272fa2fb 100644 --- a/CRM/PCP/Form/PCP.php +++ b/CRM/PCP/Form/PCP.php @@ -66,7 +66,7 @@ class CRM_PCP_Form_PCP extends CRM_Core_Form { //give the context. if (!isset($this->_context)) { - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); } $this->assign('context', $this->_context); diff --git a/CRM/Pledge/Form/Pledge.php b/CRM/Pledge/Form/Pledge.php index 0543883fe1..3452275ef6 100644 --- a/CRM/Pledge/Form/Pledge.php +++ b/CRM/Pledge/Form/Pledge.php @@ -75,7 +75,7 @@ class CRM_Pledge_Form_Pledge extends CRM_Core_Form { $this, FALSE, 'add' ); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); // check for action permissions. if (!CRM_Core_Permission::checkActionPermission('CiviPledge', $this->_action)) { diff --git a/CRM/Pledge/Form/Search.php b/CRM/Pledge/Form/Search.php index 65a6027c4d..50558aca71 100644 --- a/CRM/Pledge/Form/Search.php +++ b/CRM/Pledge/Form/Search.php @@ -79,7 +79,7 @@ class CRM_Pledge_Form_Search extends CRM_Core_Form_Search { $this->_reset = CRM_Utils_Request::retrieve('reset', 'Boolean'); $this->_force = CRM_Utils_Request::retrieve('force', 'Boolean', $this, FALSE); $this->_limit = CRM_Utils_Request::retrieve('limit', 'Positive', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'search'); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'search'); $this->assign("context", $this->_context); diff --git a/CRM/Pledge/Page/Payment.php b/CRM/Pledge/Page/Payment.php index 36fcc526b9..2461c85c8f 100644 --- a/CRM/Pledge/Page/Payment.php +++ b/CRM/Pledge/Page/Payment.php @@ -39,7 +39,7 @@ class CRM_Pledge_Page_Payment extends CRM_Core_Page { */ public function run() { $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->assign('action', $this->_action); $this->assign('context', $this->_context); diff --git a/CRM/Pledge/Page/Tab.php b/CRM/Pledge/Page/Tab.php index 5f6a30592c..649963c8f7 100644 --- a/CRM/Pledge/Page/Tab.php +++ b/CRM/Pledge/Page/Tab.php @@ -94,7 +94,7 @@ class CRM_Pledge_Page_Tab extends CRM_Core_Page { } public function preProcess() { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); $this->_action = CRM_Utils_Request::retrieve('action', 'String', $this, FALSE, 'browse'); $this->_id = CRM_Utils_Request::retrieve('id', 'Positive', $this); @@ -156,7 +156,7 @@ class CRM_Pledge_Page_Tab extends CRM_Core_Page { * @param $form */ public static function setContext(&$form) { - $context = CRM_Utils_Request::retrieve('context', 'String', $form, FALSE, 'search'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $form, FALSE, 'search'); $qfKey = CRM_Utils_Request::retrieve('key', 'String', $form); // validate the qfKey diff --git a/CRM/Price/Page/Set.php b/CRM/Price/Page/Set.php index d15f19305e..4511ac55c9 100644 --- a/CRM/Price/Page/Set.php +++ b/CRM/Price/Page/Set.php @@ -224,7 +224,7 @@ class CRM_Price_Page_Set extends CRM_Core_Page { public function preview($sid) { $controller = new CRM_Core_Controller_Simple('CRM_Price_Form_Preview', ts('Preview Price Set'), NULL); $session = CRM_Core_Session::singleton(); - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); if ($context == 'field') { $session->pushUserContext(CRM_Utils_System::url('civicrm/admin/price/field', "action=browse&sid={$sid}")); } diff --git a/CRM/Profile/Form.php b/CRM/Profile/Form.php index 0ea1e4e509..eb3d135056 100644 --- a/CRM/Profile/Form.php +++ b/CRM/Profile/Form.php @@ -195,7 +195,7 @@ class CRM_Profile_Form extends CRM_Core_Form { $this->_id = $this->get('id'); $this->_profileIds = $this->get('profileIds'); $this->_grid = CRM_Utils_Request::retrieve('grid', 'Integer', $this); - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); //unset from session when $_GET doesn't have it //except when the form is submitted diff --git a/CRM/Profile/Form/Edit.php b/CRM/Profile/Form/Edit.php index c01a868c06..ada0354e0a 100644 --- a/CRM/Profile/Form/Edit.php +++ b/CRM/Profile/Form/Edit.php @@ -62,7 +62,7 @@ class CRM_Profile_Form_Edit extends CRM_Profile_Form { $this->assign('onPopupClose', $this->_onPopupClose); //set the context for the profile - $this->_context = CRM_Utils_Request::retrieve('context', 'String', $this); + $this->_context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); //set the block no $this->_blockNo = CRM_Utils_Request::retrieve('blockNo', 'String', $this); diff --git a/CRM/Report/Form/Activity.php b/CRM/Report/Form/Activity.php index 9f2680e06f..b38b95d24d 100644 --- a/CRM/Report/Form/Activity.php +++ b/CRM/Report/Form/Activity.php @@ -930,7 +930,7 @@ GROUP BY civicrm_activity_id $having {$this->_orderBy}"; $activityStatus = CRM_Core_PseudoConstant::activityStatus(); $priority = CRM_Core_PseudoConstant::get('CRM_Activity_DAO_Activity', 'priority_id'); $viewLinks = FALSE; - $context = CRM_Utils_Request::retrieve('context', 'String', $this, FALSE, 'report'); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this, FALSE, 'report'); $actUrl = ''; if (CRM_Core_Permission::check('access CiviCRM')) { diff --git a/CRM/UF/Page/Group.php b/CRM/UF/Page/Group.php index c737632a41..c87feb2e6d 100644 --- a/CRM/UF/Page/Group.php +++ b/CRM/UF/Page/Group.php @@ -406,7 +406,7 @@ class CRM_UF_Page_Group extends CRM_Core_Page { * @param $action */ public function setContext($id, $action) { - $context = CRM_Utils_Request::retrieve('context', 'String', $this); + $context = CRM_Utils_Request::retrieve('context', 'Alphanumeric', $this); //we need to differentiate context for update and preview profile. if (!$context && !($action & (CRM_Core_Action::UPDATE | CRM_Core_Action::PREVIEW))) { -- 2.25.1