From 420dfcbdbfd1a3008f8095ee4ecebe9da749cb1b Mon Sep 17 00:00:00 2001 From: Johannes Meyer Date: Fri, 14 Jan 2022 11:24:20 +0100 Subject: [PATCH] Avoid passing non-string args to `ctype_*()` functions --- library/Director/Data/ValueFilter/FilterInt.php | 4 ++-- library/Director/Web/Table/QuickTable.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/library/Director/Data/ValueFilter/FilterInt.php b/library/Director/Data/ValueFilter/FilterInt.php index b3de294c..d51ce8d6 100644 --- a/library/Director/Data/ValueFilter/FilterInt.php +++ b/library/Director/Data/ValueFilter/FilterInt.php @@ -8,11 +8,11 @@ class FilterInt implements ValueFilter { public function filter($value) { - if ($value === '') { + if ($value === '' || $value === null) { return null; } - if (! ctype_digit($value)) { + if (is_string($value) && ! ctype_digit($value)) { return $value; } diff --git a/library/Director/Web/Table/QuickTable.php b/library/Director/Web/Table/QuickTable.php index 83842f2c..ff3edcc0 100644 --- a/library/Director/Web/Table/QuickTable.php +++ b/library/Director/Web/Table/QuickTable.php @@ -473,7 +473,7 @@ abstract class QuickTable implements Paginatable, ValidHtml protected function valueToTimestamp($value) { // We consider integers as valid timestamps. Does not work for URL params - if (ctype_digit($value)) { + if (! is_string($value) || ctype_digit($value)) { return $value; } $value = strtotime($value);