[ticket/security-155] Cast the types of string values in the controller routes

nickvergessen · nickvergessen · commit 558aff46cd7a · 2014-08-08T17:15:01.000+02:00
SECURITY-155
diff --git a/phpBB/phpbb/controller/resolver.php b/phpBB/phpbb/controller/resolver.php
@@ -40,6 +40,12 @@ class resolver implements ControllerResolverInterface
 	*/
 	protected $template;
 
+	/**
+	* Requst type cast helper object
+	* @var \phpbb\request\type_cast_helper
+	*/
+	protected $type_cast_helper;
+
 	/**
 	* phpBB root path
 	* @var string
@@ -59,6 +65,7 @@ public function __construct(\phpbb\user $user, ContainerInterface $container, $p
 		$this->user = $user;
 		$this->container = $container;
 		$this->template = $template;
+		$this->type_cast_helper = new \phpbb\request\type_cast_helper();
 		$this->phpbb_root_path = $phpbb_root_path;
 	}
 
@@ -138,7 +145,16 @@ public function getArguments(Request $request, $controller)
 		{
 			if (array_key_exists($param->name, $attributes))
 			{
-				$arguments[] = $attributes[$param->name];
+				if (is_string($attributes[$param->name]))
+				{
+					$value = $attributes[$param->name];
+					$this->type_cast_helper->set_var($value, $attributes[$param->name], 'string', true, false);
+					$arguments[] = $value;
+				}
+				else
+				{
+					$arguments[] = $attributes[$param->name];
+				}
 			}
 			else if ($param->getClass() && $param->getClass()->isInstance($request))
 			{
