commit 6156a9b6dc24cba2d55a4e6e15f56840fed02ae5
Author: Jocelyn Delande <jocelyn at delalande dot fr>
Date:   Wed Dec 25 16:59:50 2013 +0100

    some request input checking/sanitization

diff --git a/class/FormValidator.class.php b/class/FormValidator.class.php
index 5be9de8..4c89339 100644
--- a/class/FormValidator.class.php
+++ b/class/FormValidator.class.php
@@ -58,8 +58,7 @@ class FormValidator {
 			}
 		}
 		$this->sanitized = $sanitized;
-
-		return ($err == false);
+		return (count($this->errors) == 0);
 	}
 
 	public function validate_field($validator, $content) {
@@ -83,6 +82,14 @@ class FormValidator {
 		return $this->sanitized;
 	}
 
+	public function print_errors() {
+		/** raw & quick HTML errors printing, for case that shouldn't happen to users.
+		 */
+		echo '<pre>';
+		var_dump($this->errors());
+		echo '</pre>';
+	}
+
 	public static function register($name, $function) {
 		self::$field_validators[$name] = $function;
 	}
@@ -124,4 +131,17 @@ FormValidator::register(
   }
 );
 
+// Validate that it is not a file path
+FormValidator::register(
+  'basename',
+  function ($v) {
+	  if (!strpos($v, '/') && !strpos($v, '\\')) {
+		  return $v;
+	  } else {
+		  throw new FieldValidationError('est un chemin');
+	  }
+  }
+);
+
+
 ?>
diff --git a/class/site_point.class.php b/class/site_point.class.php
index 8aef257..6f5d0a1 100644
--- a/class/site_point.class.php
+++ b/class/site_point.class.php
@@ -27,6 +27,10 @@ class site_point {
 	  return $this->base_dir.'/'.$this->prefix.'.params';
   }
 
+  public function tiles_url_prefix() {
+	  return PANORAMA_FOLDER.'/'.$this->prefix;
+  }
+
   public function tiles_path() {
 	  return $this->base_dir;
   }
diff --git a/genererPano.php b/genererPano.php
index a17a599..7502bd7 100644
--- a/genererPano.php
+++ b/genererPano.php
@@ -1,3 +1,24 @@
+<?php
+require_once 'class/utils.class.php';
+require_once 'class/site_point.class.php';
+require_once 'class/TilesGenerator.php';
+require_once 'constants.inc.php';
+
+
+$fields_spec = array(
+  'name'   => array('required', 'basename'), // name of the field within uploads dir
+  'wizard' => array('boolean')
+);
+
+$validator = new FormValidator($fields_spec);
+$is_valid = $validator->validate($_GET);
+
+if ($is_valid) {
+  $input = $validator->sane_values();
+}
+
+?>
+
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
 <head>
@@ -7,16 +28,13 @@
 </head>
 
 <body>
-<?php
-require_once 'class/utils.class.php';
-require_once 'class/site_point.class.php';
-require_once 'class/TilesGenerator.php';
-require_once 'constants.inc.php';
 
-if (isset($_GET['name'])) {
-  $image_path = UPLOAD_PATH.'/'.$_GET['name'];
+<?
+
+if ($is_valid) {
+  $image_path = UPLOAD_PATH.'/'.$input['name'];
   // We init the panorama with the same name as image.
-  $pano_name = utils::strip_extension($_GET['name']);
+  $pano_name = utils::strip_extension($input['name']);
   $panorama = site_point::get($pano_name);
 
   $tiles_generator = new TilesGenerator($image_path, $panorama);
@@ -39,7 +57,7 @@ if (isset($_GET['name'])) {
 
 
     // Redirect in js to sumary page
-    if ($_GET['wizard']) {
+    if ($input['wizard']) {
       printf('<script>window.location=\'panoInfo.php?name=%s\'</script>\n', $pano_name);
     }
 
@@ -49,6 +67,8 @@ if (isset($_GET['name'])) {
     printf("<h4><span class=\"error\">%s</span></h4>\n", $e->getMessage());
     print("</pre>\n");
   }
+} else { 
+  $validator->print_errors(); 
 }
 ?>
 </body>
diff --git a/panoInfo.php b/panoInfo.php
index 862d7e2..95c66c4 100644
--- a/panoInfo.php
+++ b/panoInfo.php
@@ -1,22 +1,35 @@
 <?php
-require_once 'class/site_point.class.php';
+require_once('class/site_point.class.php');
+require_once('class/FormValidator.class.php');
 
+$fields_spec = array('name' => array('required', 'basename'));
+
+$validator = new FormValidator($fields_spec);
+
+$is_valid = $validator->validate($_GET);
 
-$pano = site_point::get($_GET['name']);
 
-if ($pano->has_params()) {
-  $params = $pano->get_params();
-  $title = $params['titre'];
-  $lat = $params['latitude'];
-  $lon = $params['longitude'];
-} else {
-  $title = $__GET['name'];
-}
 
+if ($is_valid) {
+  $input = $validator->sane_values();
+  $pano = site_point::get($input['name']);
+  
+  if ($pano->has_params()) {
+    $params = $pano->get_params();
+    $title = $params['titre'];
+    $lat = $params['latitude'];
+    $lon = $params['longitude'];
+  } else {
+    $title = $input['name'];
+  }
 
-$has_tiles = $pano->has_tiles();//TODO
-$has_params = $pano->has_params();
-$src_path = $pano->src_path();
+
+  $has_tiles = $pano->has_tiles();//TODO
+  $has_params = $pano->has_params();
+  $src_path = $pano->src_path();
+} else {
+  $validation_errors = $validator->errors();
+}
  ?>
 
 <!DOCTYPE html>
@@ -31,6 +44,7 @@ $src_path = $pano->src_path();
       <h1><img src="images/tetaneutral.svg" alt="tetaneutral.net"/></h1>
     </header>
     <section id="main">
+<?php if ($is_valid) { ?>
       <h2><?php echo $title ?></h2>
       <ul id="pano-list">
         <li>
@@ -58,6 +72,9 @@ $src_path = $pano->src_path();
           <?php } ?>
         </li>
       </ul>
+<?php } else { 
+  $validator->print_errors(); 
+}?>
     </section>
     <footer class="validators"><samp>
       page validée par
diff --git a/panorama.php b/panorama.php
index dfe43f0..0bd234e 100644
--- a/panorama.php
+++ b/panorama.php
@@ -5,24 +5,42 @@
    require 'class/utils.class.php';
    require_once 'constants.inc.php';
 
+  $fields_spec = array(
+    'panorama'   => array('basename'),
+    'dir'        => array(),//fixme
+    'to_cap'     => array('numeric'),
+    'to_ele'     => array('numeric'),
+    'to_zoom'     => array('numeric')
+  );
+  
+  $validator = new FormValidator($fields_spec);
+  $is_valid = $validator->validate($_GET);
+  
+  if ($is_valid) {
+    $input = $validator->sane_values();
+  } else {
+    $validator->print_errors();
+    die();//fixme, could be cleaner
+  }
+  
    $form_extpoint = file_get_contents('html/form_extpoint.html');
 
    $form_param = file_get_contents('html/form_param.html');
 
-   if (isset($_GET['dir']) && isset($_GET['panorama'])) {
-     $dir   = $_GET['dir'];
-     $name  = $_GET['panorama'];
+   if (isset($input['dir']) && isset($input['panorama'])) {
+     $dir   = $input['dir'];
+     $name  = $input['panorama'];
    } else {
      $dir   = PANORAMA_PATH;
      $name  = 'ttn_mediatheque';
    }
    $opt_vals = array();
    foreach(array('to_cap', 'to_ele', 'to_zoom') as $val) {
-     if (!empty($_GET[$val])) $opt_vals[$val] = $_GET[$val];
+     if (!empty($input[$val])) $opt_vals[$val] = $input[$val];
    }
 
-   $base_dir = $dir.'/'.$name;
-   $pt = new site_point($base_dir);
+   $pt = site_point::get($input['panorama']);
+   $base_dir = $pt->tiles_url_prefix();
    if(!$pt) die("impossible d'accéder à ".$base_dir." !\n");
    $params = $pt->get_params();
    $prefix = $pt->get_prefix();
@@ -140,8 +158,8 @@
        print("</div>\n");
        echo $form_extpoint;
      } elseif ($params == false ) {
-     	$dir   = $_GET['dir'];
-        $name  = $_GET['panorama'];
+     	$dir   = $input['dir'];
+        $name  = $input['panorama'];
         printf($form_param, $name, $name);
      }
      echo '<p id="info"></p>'."\n";
