From 3860d465870894ac050f5e71de0e356802e9ca6d Mon Sep 17 00:00:00 2001
From: Coleman Watts <coleman@civicrm.org>
Date: Tue, 17 Nov 2015 16:11:37 -0500
Subject: [PATCH] CRM-13823 - Better validation of PSR level

---
 CRM/Utils/Check.php         | 20 ++++++++++++++------
 CRM/Utils/Check/Message.php | 10 ++++++++--
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/CRM/Utils/Check.php b/CRM/Utils/Check.php
index 4aeba74f6f..7833779407 100644
--- a/CRM/Utils/Check.php
+++ b/CRM/Utils/Check.php
@@ -146,19 +146,27 @@ class CRM_Utils_Check {
   /**
    * Get the integer value (useful for thresholds) of the severity.
    *
-   * @param int|const $severity
+   * @param int|string $severity
    *   the value to look up
    * @param bool $reverse
    *   whether to find the constant from the integer
-   * @return bool
+   * @return string|int
+   * @throws \CRM_Core_Exception
    */
   public static function severityMap($severity, $reverse = FALSE) {
-    // Lowercase string-based severities
-    if (!$reverse) {
+    if ($reverse) {
+      if (isset(self::$severityList[$severity])) {
+        return self::$severityList[$severity];
+      }
+    }
+    else {
+      // Lowercase string-based severities
       $severity = strtolower($severity);
+      if (in_array($severity, self::$severityList)) {
+        return array_search($severity, self::$severityList);
+      }
     }
-
-    return ($reverse) ? self::$severityList[$severity] : array_search($severity, self::$severityList);
+    throw new CRM_Core_Exception('Invalid PSR Severity Level');
   }
 
   /**
diff --git a/CRM/Utils/Check/Message.php b/CRM/Utils/Check/Message.php
index d673091b29..caccaa3c01 100644
--- a/CRM/Utils/Check/Message.php
+++ b/CRM/Utils/Check/Message.php
@@ -89,15 +89,21 @@ class CRM_Utils_Check_Message {
    *   The severity of the message. Use PSR-3 log levels.
    *
    * @see Psr\Log\LogLevel
+   *
+   * @throws \CRM_Core_Exception
    */
   public function __construct($name, $message, $title, $level = \Psr\Log\LogLevel::WARNING, $icon = NULL) {
     $this->name = $name;
     $this->message = $message;
     $this->title = $title;
-    // Handle non-integer severity levels.
-    if (!CRM_Utils_Rule::integer($level)) {
+    // Convert level to integer
+    if (!CRM_Utils_Rule::positiveInteger($level)) {
       $level = CRM_Utils_Check::severityMap($level);
     }
+    else {
+      // Validate numeric input - this will throw an exception if invalid
+      CRM_Utils_Check::severityMap($level, TRUE);
+    }
     $this->level = $level;
     $this->icon = $icon;
   }
-- 
2.25.1