xpressengine /
xe-core
| @@ 498-520 (lines=23) @@ | ||
| 495 | } |
|
| 496 | ||
| 497 | // check REQUEST_METHOD in controller |
|
| 498 | if($type == 'controller') |
|
| 499 | { |
|
| 500 | $allowedMethod = $xml_info->action->{$this->act}->method; |
|
| 501 | ||
| 502 | if(!$allowedMethod) |
|
| 503 | { |
|
| 504 | $allowedMethodList[0] = 'POST'; |
|
| 505 | } |
|
| 506 | else |
|
| 507 | { |
|
| 508 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 509 | } |
|
| 510 | ||
| 511 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 512 | { |
|
| 513 | $this->error = "msg_invalid_request"; |
|
| 514 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 515 | $oMessageObject->setError(-1); |
|
| 516 | $oMessageObject->setMessage($this->error); |
|
| 517 | $oMessageObject->dispMessage(); |
|
| 518 | return $oMessageObject; |
|
| 519 | } |
|
| 520 | } |
|
| 521 | ||
| 522 | if($this->module_info->use_mobile != "Y") |
|
| 523 | { |
|
| @@ 648-670 (lines=23) @@ | ||
| 645 | ||
| 646 | // SECISSUE also check foward act method |
|
| 647 | // check REQUEST_METHOD in controller |
|
| 648 | if($type == 'controller') |
|
| 649 | { |
|
| 650 | $allowedMethod = $xml_info->action->{$forward->act}->method; |
|
| 651 | ||
| 652 | if(!$allowedMethod) |
|
| 653 | { |
|
| 654 | $allowedMethodList[0] = 'POST'; |
|
| 655 | } |
|
| 656 | else |
|
| 657 | { |
|
| 658 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 659 | } |
|
| 660 | ||
| 661 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 662 | { |
|
| 663 | $this->error = "msg_invalid_request"; |
|
| 664 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 665 | $oMessageObject->setError(-1); |
|
| 666 | $oMessageObject->setMessage($this->error); |
|
| 667 | $oMessageObject->dispMessage(); |
|
| 668 | return $oMessageObject; |
|
| 669 | } |
|
| 670 | } |
|
| 671 | ||
| 672 | if($type == "view" && Mobile::isFromMobilePhone()) |
|
| 673 | { |
|
