Security fix.

subhh · May 17, 2022 · 8d32d7b · 8d32d7b
1 parent fe386fe
commit 8d32d7b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/Classes/Controller/EzbController.php b/Classes/Controller/EzbController.php
@@ -445,6 +445,16 @@ public function displayParticipantsFormAction() {
             $params = \TYPO3\CMS\Core\Utility\GeneralUtility::_GPmerged('libconnect');
         }
 
+        //error - wrong jourid
+        if(!is_numeric($params['jourid']) || is_empty($params['jourid'])){
+            //change view
+            $controllerContext = $this->buildControllerContext();
+            $controllerContext->getRequest()->setControllerActionName('displayError');
+            $this->view->setControllerContext($controllerContext);
+
+            return;
+        }
+
         $ParticipantsList =  $this->ezbRepository->getParticipantsList($params['jourid']);
 
         $config['partnerPid'] = 0;

diff --git a/Resources/Private/Templates/Ezb/DisplayError.html b/Resources/Private/Templates/Ezb/DisplayError.html
@@ -0,0 +1,4 @@
+<f:layout name="Default" />
+<f:section name="main">
+
+</f:section>