Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions classes/DataWarehouse/Access/MetricExplorer.php
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,10 @@ class MetricExplorer extends Common
{
public function get_data($user)
{
if(isset($this->request['config'])) {
$config = json_decode($this->request['config'], true);
$this->request = array_merge($config, $this->request);
}
$requestedFormat = $this->request['format'] ?? null;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do you know that the json_decode is not necessary any more?


$format = \DataWarehouse\ExportBuilder::getFormat(
$this->request,
$format = \DataWarehouse\ExportBuilder::validateFormat(
$requestedFormat,
'png',
array(
'svg',
Expand Down
59 changes: 24 additions & 35 deletions classes/DataWarehouse/ExportBuilder.php
Original file line number Diff line number Diff line change
Expand Up @@ -227,41 +227,6 @@ public static function writeHeader(
}
}

/**
* Get the output format from a request.
*
* @param array $request The HTTP request data.
* @param string $default The default output format
* (defaults to "jsonstore").
* @param array $format_subset The allowed subset of formats. If
* the format specified by the request is not in this array,
* the default format will be used.
*/
public static function getFormat(
array $request,
$default = 'jsonstore',
array $formats_subset = array()
) {
$format = $default;

if (isset($request['format'])) {
$f = strtolower($request['format']);

if (
isset(static::$supported_formats[$f])
&& (
count($formats_subset) == 0
||
(count($formats_subset) > 0 && array_search($f, $formats_subset) !== false)
)
) {
$format = $f;
}
}

return $format;
}

/**
* Export data.
*
Expand Down Expand Up @@ -620,4 +585,28 @@ private static function formatElement($name)

return $name;
}

/** Validates that the format requested by the user is located in the set of formats that are supported and either
* all formats are allowed ( signified by there being no $allowedFormats ) or the requested format was found in the
* set of allowed formats. If valid the requested format is returned. If no requested format is provided then the
* default value will be returned.
*
* @param string $requestedFormat
* @param string $default
* @param array $allowedFormats
* @return string
*/
public static function validateFormat(string $requestedFormat, string $default, array $allowedFormats): string
{
if (!isset($requestedFormat)) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible for isset() to return false here?

return $default;
}
$requestedFormat = strtolower($requestedFormat);
$formatSupported = isset(self::$supported_formats[$requestedFormat]);
$noFormatSubset = count($allowedFormats) === 0;
$requestedFormatInSubset = in_array($requestedFormat, $allowedFormats);


return $formatSupported && ($noFormatSubset || $requestedFormatInSubset) ? $requestedFormat : $default;
}
}
14 changes: 3 additions & 11 deletions html/controllers/metric_explorer/get_rawdata.php
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,10 @@

$start = microtime(true);
try {
if (isset($_REQUEST['config'])) {
$config = json_decode($_REQUEST['config'], true);
$_REQUEST = array_merge($config, $_REQUEST);
}

$format = \DataWarehouse\ExportBuilder::getFormat(
$_REQUEST,
'jsonstore',
array(
'jsonstore'
)
);
$requestedFormat = $_REQUEST['format'] ?? null;

$format = \DataWarehouse\ExportBuilder::validateFormat($requestedFormat, 'jsonstore', ['jsonstore']);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The definition for the new validateFormat function requires a string, but this code could pass in a null which will give a TypeError exception.


$user = \xd_security\detectUser(
array(XDUser::INTERNAL_USER, XDUser::PUBLIC_USER)
Expand Down