xpressengine /
xe-core
| @@ 412-434 (lines=23) @@ | ||
| 409 | } |
|
| 410 | ||
| 411 | // check REQUEST_METHOD in controller |
|
| 412 | if($type == 'controller') |
|
| 413 | { |
|
| 414 | $allowedMethod = $xml_info->action->{$this->act}->method; |
|
| 415 | ||
| 416 | if(!$allowedMethod) |
|
| 417 | { |
|
| 418 | $allowedMethodList[0] = 'POST'; |
|
| 419 | } |
|
| 420 | else |
|
| 421 | { |
|
| 422 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 423 | } |
|
| 424 | ||
| 425 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 426 | { |
|
| 427 | $this->error = "msg_invalid_request"; |
|
| 428 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 429 | $oMessageObject->setError(-1); |
|
| 430 | $oMessageObject->setMessage($this->error); |
|
| 431 | $oMessageObject->dispMessage(); |
|
| 432 | return $oMessageObject; |
|
| 433 | } |
|
| 434 | } |
|
| 435 | ||
| 436 | if($this->module_info->use_mobile != "Y") |
|
| 437 | { |
|
| @@ 562-584 (lines=23) @@ | ||
| 559 | ||
| 560 | // SECISSUE also check foward act method |
|
| 561 | // check REQUEST_METHOD in controller |
|
| 562 | if($type == 'controller') |
|
| 563 | { |
|
| 564 | $allowedMethod = $xml_info->action->{$forward->act}->method; |
|
| 565 | ||
| 566 | if(!$allowedMethod) |
|
| 567 | { |
|
| 568 | $allowedMethodList[0] = 'POST'; |
|
| 569 | } |
|
| 570 | else |
|
| 571 | { |
|
| 572 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 573 | } |
|
| 574 | ||
| 575 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 576 | { |
|
| 577 | $this->error = "msg_invalid_request"; |
|
| 578 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 579 | $oMessageObject->setError(-1); |
|
| 580 | $oMessageObject->setMessage($this->error); |
|
| 581 | $oMessageObject->dispMessage(); |
|
| 582 | return $oMessageObject; |
|
| 583 | } |
|
| 584 | } |
|
| 585 | ||
| 586 | if($type == "view" && Mobile::isFromMobilePhone()) |
|
| 587 | { |
|
