mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-21 02:07:23 -04:00
fix(Jobs): anchor throttle field regex to prevent id extraction bugs
Throttle POST field parsing used preg_replace with an unanchored
lazy pattern to pull numeric ids out of field names, which could
mis-extract or silently fall through on unexpected key formats.
- Replace preg_replace('/.*?_(\d+)$/', ...) with preg_match against
an anchored pattern ('/^throttle_count_(\d+)$/' and
'/^throttle_period_(\d+)$/') in app/Controllers/Jobs.php
- Only process the key when the anchored pattern actually matches,
avoiding bogus $throttleId values feeding $arraySave/$notToDelete
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
This commit is contained in:
1 parent
b40d1bb82b
commit
9f70efb592
1 file changed
+4
-4
@@ -88,12 +88,12 @@ class Jobs extends Secure_Controller
|
||||
$arraySave = [];
|
||||
|
||||
foreach ($this->request->getPost() as $key => $value) {
|
||||
if (str_starts_with($key, 'throttle_count_')) {
|
||||
$throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
|
||||
if (str_starts_with($key, 'throttle_count_') && preg_match('/^throttle_count_(\d+)$/', $key, $matches)) {
|
||||
$throttleId = $matches[1];
|
||||
$notToDelete[] = $throttleId;
|
||||
$arraySave[$throttleId]['max_count'] = $value;
|
||||
} elseif (str_starts_with($key, 'throttle_period_')) {
|
||||
$throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
|
||||
} elseif (str_starts_with($key, 'throttle_period_') && preg_match('/^throttle_period_(\d+)$/', $key, $matches)) {
|
||||
$throttleId = $matches[1];
|
||||
$arraySave[$throttleId]['period'] = $value;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user