From c7ae6826d8fd24f07cbcf9c08092273cb70e0312 Mon Sep 17 00:00:00 2001 From: Andrew McMillan Date: Wed, 12 Jan 2011 10:03:36 +1300 Subject: [PATCH] Validate alarm date-time or duration before adding it to the DB. Signed-off-by: Andrew McMillan --- inc/caldav-PUT-functions.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/inc/caldav-PUT-functions.php b/inc/caldav-PUT-functions.php index 732cc2fc..f7ea1b2a 100644 --- a/inc/caldav-PUT-functions.php +++ b/inc/caldav-PUT-functions.php @@ -669,12 +669,16 @@ function write_alarms( $dav_id, $ical ) { default: $related = $ical->GetPValue('DTSTART'); } $duration = $trigger->Value(); + if ( !preg_match('{^-?P(:?\d+W)?(:?\d+D)?(:?T(:?\d+H)?(:?\d+M)?(:?\d+S)?)?$}', $duration ) ) continue; $minus = (substr($duration,0,1) == '-'); $related_trigger = trim(preg_replace( '#[PT-]#', ' ', $duration )); if ( $minus ) { $related_trigger = preg_replace( '{(\d+[WDHMS])}', '-$1 ', $related_trigger ); } } + else { + if ( false === strtotime($trigger->Value()) ) continue; // Invalid date. + } $qry->Bind(':action', $v->GetPValue('ACTION')); $qry->Bind(':trigger', $trigger->Render()); $qry->Bind(':summary', $v->GetPValue('SUMMARY'));