feat: Sanitize invalid datetimes

KminekMatej · Sep 6, 2024 · c415da7 · c415da7
1 parent ff03b39
commit c415da7
Showing 1 changed file with 20 additions and 4 deletions.
diff --git a/app/module/event/manager/EventManager.php b/app/module/event/manager/EventManager.php
@@ -302,12 +302,24 @@ protected function allowCreate(?array &$data = null): void
         if (!isset($data["endTime"])) {
             $data["endTime"] = $data["startTime"];
         }
-        if (!isset($data["closeTime"])) {
+
+        try {
+            $closeTimeDT = new DateTime($data["closeTime"]);
+        } catch (Exception $exc) {
+            $this->respondBadRequest($this->translator->translate("event.close") . ": " . $this->translator->translate("common.errors.valueInvalid"));
+        }
+
+        try {
+            $startTimeDT = new DateTime($data["startTime"]);
+        } catch (Exception $exc) {
+            $this->respondBadRequest($this->translator->translate("event.start") . ": " . $this->translator->translate("common.errors.valueInvalid"));
         }
 
-        $closeTimeDT = new DateTime($data["closeTime"]);
-        $startTimeDT = new DateTime($data["startTime"]);
-        $endTimeDT = new DateTime($data["endTime"]);
+        try {
+            $endTimeDT = new DateTime($data["endTime"]);
+        } catch (Exception $exc) {
+            $this->respondBadRequest($this->translator->translate("event.end") . ": " . $this->translator->translate("common.errors.valueInvalid"));
+        }
 
         if ($closeTimeDT > $startTimeDT) {
             $this->respondBadRequest($this->translator->translate("event.errors.closeAfterStart"));
@@ -346,6 +358,10 @@ protected function allowRead(?int $recordId = null): void
         if ($recordId) {
             $this->event = $this->getById($recordId);
 
+            if (!$this->event) {
+                $this->respondNotFound(Event::MODULE, $recordId);
+            }
+
             if (!$this->canRead($this->event, $this->user->getId())) {
                 $this->responder->E4001_VIEW_NOT_PERMITTED(Event::MODULE, $recordId);
             }