xpressengine /
xe-core
| @@ 382-404 (lines=23) @@ | ||
| 379 | } |
|
| 380 | ||
| 381 | // check REQUEST_METHOD in controller |
|
| 382 | if($type == 'controller') |
|
| 383 | { |
|
| 384 | $allowedMethod = $xml_info->action->{$this->act}->method; |
|
| 385 | ||
| 386 | if(!$allowedMethod) |
|
| 387 | { |
|
| 388 | $allowedMethodList[0] = 'POST'; |
|
| 389 | } |
|
| 390 | else |
|
| 391 | { |
|
| 392 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 393 | } |
|
| 394 | ||
| 395 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 396 | { |
|
| 397 | $this->error = "msg_invalid_request"; |
|
| 398 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 399 | $oMessageObject->setError(-1); |
|
| 400 | $oMessageObject->setMessage($this->error); |
|
| 401 | $oMessageObject->dispMessage(); |
|
| 402 | return $oMessageObject; |
|
| 403 | } |
|
| 404 | } |
|
| 405 | ||
| 406 | if($this->module_info->use_mobile != "Y") |
|
| 407 | { |
|
| @@ 532-554 (lines=23) @@ | ||
| 529 | ||
| 530 | // SECISSUE also check foward act method |
|
| 531 | // check REQUEST_METHOD in controller |
|
| 532 | if($type == 'controller') |
|
| 533 | { |
|
| 534 | $allowedMethod = $xml_info->action->{$forward->act}->method; |
|
| 535 | ||
| 536 | if(!$allowedMethod) |
|
| 537 | { |
|
| 538 | $allowedMethodList[0] = 'POST'; |
|
| 539 | } |
|
| 540 | else |
|
| 541 | { |
|
| 542 | $allowedMethodList = explode('|', strtoupper($allowedMethod)); |
|
| 543 | } |
|
| 544 | ||
| 545 | if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) |
|
| 546 | { |
|
| 547 | $this->error = "msg_invalid_request"; |
|
| 548 | $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
|
| 549 | $oMessageObject->setError(-1); |
|
| 550 | $oMessageObject->setMessage($this->error); |
|
| 551 | $oMessageObject->dispMessage(); |
|
| 552 | return $oMessageObject; |
|
| 553 | } |
|
| 554 | } |
|
| 555 | ||
| 556 | if($type == "view" && Mobile::isFromMobilePhone()) |
|
| 557 | { |
|
