Forum OpenACS Q&A: Is there ever a case that a form variable ends in _id but it isn't an integer?

Collapse
1: Is there ever a case that a form variable ends in _id but it isn't an integer?
Posted by David Walker on 06/14/01 12:23 AM
Is there ever a case that a form variable ends in _id but it isn't an integer?

I'm modifying check_for_form_variable_naughtiness on my servers so that if a variable ends in "_id" it must be an integer. This fixes half of the bug I reported on the photodb module, assuming the answer to the above question is no.
Collapse
2: Response to Is there ever a case that a form variable ends in _id but it isn't an integer? (response to 1)
Posted by Vinod Kurup on 06/14/01 12:35 AM
Hi David,

I know that bboard uses non-integers as msg_id.

I just happened to look at the sdm today (sure wish those notifications worked) and noticed your bug in photodb, so I've been going through and fixing the validation throughout the module. I should have it done by the weekend and I'll post a patch.

Collapse
3: Response to Is there ever a case that a form variable ends in _id but it isn't an integer? (response to 1)
Posted by David Walker on 06/14/01 01:33 AM
That'll be great. Thanks.

I've changed my check to allow alphanumeric ( [string is alnum $value]) which should allow any valid msg_id through while still stopping any characters that would do bad things.
Collapse
4: Response to Is there ever a case that a form variable ends in _id but it isn't an integer? (response to 1)
Posted by Vinod Kurup on 06/20/01 05:40 AM
I finished my fixes and put a patch here.

I tested most of the basic functionality, but not intensively, so please let me know if you find any problems. I also fixed all of the outstanding SDM bugs in the process, so once it's tested a bit, I'll send it on to Roberto.