From 45e8fddc2e5fe363b4e478f785adbdb5de61dae7 Mon Sep 17 00:00:00 2001
From: Eileen McNaughton <eileen@fuzion.co.nz>
Date: Wed, 22 Oct 2014 11:01:45 +1300
Subject: [PATCH] CRM-15510 param retrieval issue

---
 CRM/Event/Cart/Page/CheckoutAJAX.php | 10 +++++-----
 CRM/Event/Page/AJAX.php              |  5 +++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/CRM/Event/Cart/Page/CheckoutAJAX.php b/CRM/Event/Cart/Page/CheckoutAJAX.php
index 218d85685b..7abff7d895 100644
--- a/CRM/Event/Cart/Page/CheckoutAJAX.php
+++ b/CRM/Event/Cart/Page/CheckoutAJAX.php
@@ -1,12 +1,11 @@
 <?php
 class CRM_Event_Cart_Page_CheckoutAJAX {
   function add_participant_to_cart() {
-    require 'CRM/Core/Transaction.php';
     $transaction = new CRM_Core_Transaction();
-    $cart_id     = $_GET['cart_id'];
-    $event_id    = $_GET['event_id'];
+    $cart_id = CRM_Utils_Request::retrieve('cart_id', 'Integer');
+    $event_id = CRM_Utils_Request::retrieve('event_id', 'Integer');
 
-    $cart = CRM_Event_Cart_BAO_Cart::find_by_id($_GET['cart_id']);
+    $cart = CRM_Event_Cart_BAO_Cart::find_by_id($cart_id);
 
     //XXX security
     $participant = CRM_Event_Cart_BAO_MerParticipant::create(array(
@@ -41,7 +40,8 @@ class CRM_Event_Cart_Page_CheckoutAJAX {
   }
 
   function remove_participant_from_cart() {
-    $participant = CRM_Event_Cart_BAO_MerParticipant::get_by_id($_GET['id']);
+    $id = CRM_Utils_Request::retrieve('id', 'Integer');
+    $participant = CRM_Event_Cart_BAO_MerParticipant::get_by_id($id);
     $participant->delete();
 
     CRM_Utils_System::civiExit();
diff --git a/CRM/Event/Page/AJAX.php b/CRM/Event/Page/AJAX.php
index 6e9e1fee80..06158ad9b2 100644
--- a/CRM/Event/Page/AJAX.php
+++ b/CRM/Event/Page/AJAX.php
@@ -158,8 +158,9 @@ GROUP BY cv.label";
   /**
    * Function to get default participant role
    */
-  function participantRole() {
-    $eventID = $_GET['eventId'];
+
+  static function participantRole() {
+    $eventID = CRM_Utils_Request::retrieve('eventId', 'Integer');
 
     $defaultRoleId = CRM_Core_DAO::getFieldValue('CRM_Event_DAO_Event',
       $eventID,
-- 
2.25.1