xpressengine /
xe-core
| @@ 471-493 (lines=23) @@ | ||
| 468 | } |
|
| 469 | ||
| 470 | // check REQUEST_METHOD in controller |
|
| 471 | if($type == 'controller') |
|
| 472 | { |
|
| 473 | $allowedMethod = $xml_info->action->{$this->act}->method; |
|
| 474 | ||
| 475 | if(!$allowedMethod) |
|
| 476 | { |
|
| 477 | $allowedMethodList[0] = 'POST'; |
|
| 478 | } |
|
| 479 | else |
|
| 480 | { |
|
| 481 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 482 | } |
|
| 483 | ||
| 484 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 485 | { |
|
| 486 | $this->error = "msg_invalid_request"; |
|
| 487 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 488 | $oMessageObject->setError(-1); |
|
| 489 | $oMessageObject->setMessage($this->error); |
|
| 490 | $oMessageObject->dispMessage(); |
|
| 491 | return $oMessageObject; |
|
| 492 | } |
|
| 493 | } |
|
| 494 | ||
| 495 | if($this->module_info->use_mobile != "Y") |
|
| 496 | { |
|
| @@ 621-643 (lines=23) @@ | ||
| 618 | ||
| 619 | // SECISSUE also check foward act method |
|
| 620 | // check REQUEST_METHOD in controller |
|
| 621 | if($type == 'controller') |
|
| 622 | { |
|
| 623 | $allowedMethod = $xml_info->action->{$forward->act}->method; |
|
| 624 | ||
| 625 | if(!$allowedMethod) |
|
| 626 | { |
|
| 627 | $allowedMethodList[0] = 'POST'; |
|
| 628 | } |
|
| 629 | else |
|
| 630 | { |
|
| 631 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 632 | } |
|
| 633 | ||
| 634 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 635 | { |
|
| 636 | $this->error = "msg_invalid_request"; |
|
| 637 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 638 | $oMessageObject->setError(-1); |
|
| 639 | $oMessageObject->setMessage($this->error); |
|
| 640 | $oMessageObject->dispMessage(); |
|
| 641 | return $oMessageObject; |
|
| 642 | } |
|
| 643 | } |
|
| 644 | ||
| 645 | if($type == "view" && Mobile::isFromMobilePhone()) |
|
| 646 | { |
|
