BUG: Validate parameter id to prevent XSS

core/controllers/BrowseController.php

@@ -415,6 +415,12 @@ public function getelementinfoAction()
         if (!isset($id) || !isset($element)) {
             throw new Zend_Exception('Please double check the parameters');
         }
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($id)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         $jsonContent = array('type' => $element);
         switch ($element) {
             case 'community':
@@ -502,6 +508,12 @@ public function getmaxpolicyAction()
         if (!isset($id) || !isset($type)) {
             throw new Zend_Exception('Must pass id and type parameters');
         }
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($id)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         switch (strtolower($type)) {
             case 'folder':
                 $maxpolicy = $this->Folder->getMaxPolicy($id, $this->userSession->Dao);

core/controllers/FolderController.php

@@ -48,6 +48,12 @@ public function getnameAction()
         if (!isset($folderId)) {
             throw new Zend_Exception('Must pass id parameter');
         }
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($folderId)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         $folder = $this->Folder->load($folderId);
         if (!$folder) {
             throw new Zend_Exception('Invalid folderId', 404);
@@ -69,6 +75,12 @@ public function javachildrenAction()
         if (!isset($folderId)) {
             throw new Zend_Exception('Must pass id parameter');
         }
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($folderId)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         $folder = $this->Folder->load($folderId);
         if (!$folder) {
             throw new Zend_Exception('Invalid folderId', 404);

core/controllers/ImportController.php

@@ -143,7 +143,6 @@ private function _recursiveParseDirectory($path, $currentdir)
             }
 
             if ($fileInfo->isDir()) { // we have a directory
-
                 // If the the directory actually doesn't exist at this point,
                 // skip it.
                 if (!file_exists($fileInfo->getPathName())) {

core/controllers/ShareController.php

@@ -297,6 +297,11 @@ public function linksAction()
         $type = $this->getParam('type');
         $id = $this->getParam('id');
 
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($id)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         switch ($type) {
             case 'folder':
                 $dao = $this->Folder->load($id);

core/controllers/components/ApihelperComponent.php

@@ -224,7 +224,6 @@ public function setMetadata($item, $type, $element, $qualifier, $value, $revisio
         );
         foreach ($modules as $retval) {
             if ($retval['status'] === true) { // module has handled the event, so we don't have to
-
                 return;
             }
         }

core/controllers/components/DownloadBitstreamComponent.php

@@ -159,7 +159,7 @@ public function download($bitstream, $offset = 0, $incrementDownload = false)
  *
  * @param string $key Environment variable name
  * @return string Environment variable setting
- * @link http://book.cakephp.org/view/1130/env
+ * @see http://book.cakephp.org/view/1130/env
  */
 function env($key)
 {

core/database/upgrade/3.2.6.php

@@ -83,7 +83,6 @@ private function _moveThumbnailToAssetstore($thumbnail)
 
         $oldpath = BASE_PATH.'/'.$thumbnail;
         if (!file_exists($oldpath)) { //thumbnail file no longer exists, so we remove its reference
-
             return;
         }
 

core/models/base/ItemModelBase.php

@@ -143,7 +143,6 @@ public function copyItemPolicies($itemdao, $referenceItemdao, $feeddao = null)
         }
 
         if ($feeddao != null && $feeddao instanceof FeedDao) {
-
             /** @var FeedpolicygroupModel $FeedpolicygroupModel */
             $FeedpolicygroupModel = MidasLoader::loadModel('Feedpolicygroup');
             foreach ($groupPolicies as $key => $policy) {

core/tests/models/base/FeedModelTest.php

@@ -73,13 +73,13 @@ public function testCreateFeed()
         $itemFile = $this->loadData('Item', 'default');
         $feed = $this->Feed->createFeed($usersFile[0], MIDAS_FEED_CREATE_COMMUNITY, $communityFile[0]);
         $this->assertEquals(true, $feed->saved);
-        $feed = $this->Feed->createFeed($usersFile [0], MIDAS_FEED_CREATE_FOLDER, $folderFile[0]);
+        $feed = $this->Feed->createFeed($usersFile[0], MIDAS_FEED_CREATE_FOLDER, $folderFile[0]);
         $this->assertEquals(true, $feed->saved);
-        $feed = $this->Feed->createFeed($usersFile [0], MIDAS_FEED_CREATE_ITEM, $itemFile[0]);
+        $feed = $this->Feed->createFeed($usersFile[0], MIDAS_FEED_CREATE_ITEM, $itemFile[0]);
         $this->assertEquals(true, $feed->saved);
-        $feed = $this->Feed->createFeed($usersFile [0], MIDAS_FEED_CREATE_USER, $usersFile[0]);
+        $feed = $this->Feed->createFeed($usersFile[0], MIDAS_FEED_CREATE_USER, $usersFile[0]);
         $this->assertEquals(true, $feed->saved);
-        $this->Feed->addCommunity($feed, $communityFile [0]);
+        $this->Feed->addCommunity($feed, $communityFile[0]);
         $communities = $feed->getCommunities();
         if (($communities[0]->getKey() != $communityFile[0]->getKey())) {
             $this->fail('Unable to add dao');

modules/packages/controllers/PackageController.php

@@ -34,6 +34,12 @@ public function manageAction()
         if (!isset($packageId)) {
             throw new Zend_Exception('Must specify an id parameter');
         }
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($packageId)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         $package = $this->Packages_Package->load($packageId);
         if (!$package) {
             throw new Zend_Exception('Invalid package id');

modules/pvw/controllers/components/ParaviewComponent.php

@@ -208,7 +208,6 @@ private function _getNextOpenPort()
                 }
             } elseif (!UtilityComponent::isPortListening($portEntry)
             ) { // single port check
-
                 return $portEntry;
             }
         }

modules/pvw/models/pdo/InstanceModel.php

@@ -31,7 +31,7 @@ public function getAll()
         $rows = $this->database->fetchAll($this->database->select()->setIntegrityCheck(false));
         $daos = array();
         foreach ($rows as $row) {
-            $daos [] = $this->initDao('Instance', $row, $this->moduleName);
+            $daos[] = $this->initDao('Instance', $row, $this->moduleName);
         }
 
         return $daos;

modules/scheduler/controllers/RunController.php

@@ -43,6 +43,12 @@ public function indexAction()
         $this->Setting->setConfig('lastrun', $startTime, $this->moduleName);
 
         $id = $this->getParam('id');
+
+        $validator = new Zend_Validate_Digits();
+        if (!$validator->isValid($id)) {
+            throw new Zend_Exception('Must specify an id parameter');
+        }
+
         if (isset($id)) {
             $jobs = $this->Scheduler_Job->load($id);
             if ($jobs == false) {

modules/scheduler/models/pdo/JobModel.php

@@ -77,7 +77,6 @@ public function getJobsToRun($limit = 1000)
         $minPriority = MIDAS_EVENT_PRIORITY_LOW;
         if (!empty($load)) {
             if ($load[0] > 80 || $load[1] > 80) { // don't run anything
-
                 return array();
             }
             $minPriority = MIDAS_EVENT_PRIORITY_HIGH;

modules/thumbnailcreator/database/upgrade/1.0.2.php

@@ -75,7 +75,6 @@ private function _moveThumbnailToAssetstore($thumbnail)
 
         $oldpath = BASE_PATH.'/'.$thumbnail;
         if (!file_exists($oldpath)) { //thumbnail file no longer exists, so we remove its reference
-
             return;
         }
 

modules/tracker/controllers/ProducerController.php

@@ -133,7 +133,6 @@ public function viewAction()
                 'text' => $producerDao->getDisplayName(),
                 'icon' => $this->view->baseUrl('core/public/images/icons/cog_go.png'),
             ),
-
         );
         $this->Component->Breadcrumb->setBreadcrumbHeader($breadcrumbs, $this->view);
     }

modules/tracker/models/base/ScalarModelBase.php

@@ -89,7 +89,6 @@ abstract public function getOtherScalarsFromSubmission($scalarDao);
      */
     public function addToTrend($trendDao, $submissionDao, $value)
     {
-
         /** @var Tracker_ScalarDao $scalarDao */
         $scalarDao = MidasLoader::newDao('ScalarDao', $this->moduleName);
 

modules/tracker/models/base/TrendModelBase.php

@@ -134,7 +134,6 @@ public function createIfNeeded($producerId, $metricName, $configItemId, $testDat
         $trendDao = $this->getMatch($producerId, $metricName, $configItemId, $testDatasetId, $truthDatasetId);
 
         if ($trendDao === false) {
-
             /** @var Tracker_TrendGroupModel $trendGroupModel */
             $trendGroupModel = MidasLoader::loadModel('Trendgroup', $this->moduleName);