fix: [internal] improved parameter parsing

MISP · Sep 14, 2023 · 37ecf81 · 37ecf81
1 parent 08bd232
commit 37ecf81
Showing 1 changed file with 22 additions and 2 deletions.
diff --git a/app/Controller/AppController.php b/app/Controller/AppController.php
@@ -962,6 +962,14 @@ protected function _getApiAuthUser($key, &$exception)
         return $user;
     }
 
+    private function __captureParam($data, $param, $value)
+    {
+        if ($this->modelClass->checkParam($param)) {
+            $data[$param] = $value;
+        }
+        return $data;
+    }
+
     /**
      * generic function to standardise on the collection of parameters. Accepts posted request objects, url params, named url params
      * @param array $options
@@ -982,9 +990,21 @@ protected function _harvestParameters($options, &$exception = null, $data = [])
                 return false;
             } else {
                 if (isset($request->data['request'])) {
-                    $data = array_merge($data, $request->data['request']);
+                    $temp = $request->data['request'];
                 } else {
-                    $data = array_merge($data, $request->data);
+                    $temp = $request->data;
+                }
+                if (empty($options['paramArray'])) {
+                    foreach ($options['paramArray'] as $param => $value) {
+                        $data = $this->__captureParam($data, $param, $value);
+                    }
+                    $data = array_merge($data, $temp);
+                } else {
+                    foreach ($options['paramArray'] as $param) {
+                        if (isset($temp[$param])) {
+                            $data[$param] = $temp[$param];
+                        }
+                    }
                 }
             }
         }