function clean_incoming_data()
{
global $sugar_config;
if (get_magic_quotes_gpc() == 1) {
$req = array_map("preprocess_param", $_REQUEST);
$post = array_map("preprocess_param", $_POST);
$get = array_map("preprocess_param", $_GET);
} else {
$req = array_map("securexss", $_REQUEST);
$post = array_map("securexss", $_POST);
$get = array_map("securexss", $_GET);
}
// PHP cannot stomp out superglobals reliably
foreach ($post as $k => $v) {
$_POST[$k] = $v;
}
foreach ($get as $k => $v) {
$_GET[$k] = $v;
}
foreach ($req as $k => $v) {
$_REQUEST[$k] = $v;
//ensure the keys are safe as well
securexsskey($k);
}
// Any additional variables that need to be cleaned should be added here
if (isset($_REQUEST['login_theme'])) {
clean_string($_REQUEST['login_theme']);
}
if (isset($_REQUEST['login_module'])) {
clean_string($_REQUEST['login_module']);
}
if (isset($_REQUEST['login_action'])) {
clean_string($_REQUEST['login_action']);
}
if (isset($_REQUEST['login_language'])) {
clean_string($_REQUEST['login_language']);
}
if (isset($_REQUEST['action'])) {
clean_string($_REQUEST['action']);
}
if (isset($_REQUEST['module'])) {
clean_string($_REQUEST['module']);
}
if (isset($_REQUEST['record'])) {
clean_string($_REQUEST['record'], 'STANDARDSPACE');
}
if (isset($_SESSION['authenticated_user_theme'])) {
clean_string($_SESSION['authenticated_user_theme']);
}
if (isset($_SESSION['authenticated_user_language'])) {
clean_string($_SESSION['authenticated_user_language']);
}
if (isset($_REQUEST['language'])) {
clean_string($_REQUEST['language']);
}
if (isset($sugar_config['default_theme'])) {
clean_string($sugar_config['default_theme']);
}
if (isset($_REQUEST['offset'])) {
clean_string($_REQUEST['offset']);
}
if (isset($_REQUEST['stamp'])) {
clean_string($_REQUEST['stamp']);
}
if (isset($_REQUEST['lvso'])) {
set_superglobals('lvso', strtolower($_REQUEST['lvso']) === 'desc' ? 'desc' : 'asc');
}
// Clean "offset" and "order_by" parameters in URL
foreach ($_REQUEST as $key => $val) {
if (str_end($key, "_offset")) {
clean_string($_REQUEST[$key], "ALPHANUM");
// keep this ALPHANUM for disable_count_query
set_superglobals($key, $_REQUEST[$key]);
} elseif (str_end($key, "_ORDER_BY")) {
clean_string($_REQUEST[$key], "SQL_COLUMN_LIST");
set_superglobals($key, $_REQUEST[$key]);
}
}
return 0;
}
function clean_incoming_data()
{
global $sugar_config;
global $RAW_REQUEST;
if (get_magic_quotes_gpc()) {
// magic quotes screw up data, we'd have to clean up
$RAW_REQUEST = array_map('cleanup_slashes', $_REQUEST);
} else {
$RAW_REQUEST = $_REQUEST;
}
if (get_magic_quotes_gpc() == 1) {
$req = array_map('preprocess_param', $_REQUEST);
$post = array_map('preprocess_param', $_POST);
$get = array_map('preprocess_param', $_GET);
} else {
$req = array_map('securexss', $_REQUEST);
$post = array_map('securexss', $_POST);
$get = array_map('securexss', $_GET);
}
// PHP cannot stomp out superglobals reliably
foreach ($post as $k => $v) {
$_POST[$k] = $v;
}
foreach ($get as $k => $v) {
$_GET[$k] = $v;
}
foreach ($req as $k => $v) {
$_REQUEST[$k] = $v;
//ensure the keys are safe as well. If mbstring encoding translation is on, the post keys don't
//get translated, so scrub the data but don't die
if (ini_get('mbstring.encoding_translation') === '1') {
securexsskey($k, false);
} else {
securexsskey($k, true);
}
}
// Any additional variables that need to be cleaned should be added here
if (isset($_REQUEST['login_theme'])) {
clean_string($_REQUEST['login_theme']);
}
if (isset($_REQUEST['login_module'])) {
clean_string($_REQUEST['login_module']);
}
if (isset($_REQUEST['login_action'])) {
clean_string($_REQUEST['login_action']);
}
if (isset($_REQUEST['login_language'])) {
clean_string($_REQUEST['login_language']);
}
if (isset($_REQUEST['action'])) {
clean_string($_REQUEST['action']);
}
if (isset($_REQUEST['module'])) {
clean_string($_REQUEST['module']);
}
if (isset($_REQUEST['record'])) {
clean_string($_REQUEST['record'], 'STANDARDSPACE');
}
if (isset($_SESSION['authenticated_user_theme'])) {
clean_string($_SESSION['authenticated_user_theme']);
}
if (isset($_SESSION['authenticated_user_language'])) {
clean_string($_SESSION['authenticated_user_language']);
}
if (isset($_REQUEST['language'])) {
clean_string($_REQUEST['language']);
}
if (isset($sugar_config['default_theme'])) {
clean_string($sugar_config['default_theme']);
}
if (isset($_REQUEST['offset'])) {
clean_string($_REQUEST['offset']);
}
if (isset($_REQUEST['stamp'])) {
clean_string($_REQUEST['stamp']);
}
if (isset($_REQUEST['lvso'])) {
set_superglobals('lvso', strtolower($_REQUEST['lvso']) === 'desc' ? 'desc' : 'asc');
}
// Clean "offset" and "order_by" parameters in URL
foreach ($_REQUEST as $key => $val) {
if (str_end($key, '_offset')) {
clean_string($_REQUEST[$key], 'ALPHANUM');
// keep this ALPHANUM for disable_count_query
set_superglobals($key, $_REQUEST[$key]);
} elseif (str_end($key, '_ORDER_BY')) {
clean_string($_REQUEST[$key], 'SQL_COLUMN_LIST');
set_superglobals($key, $_REQUEST[$key]);
}
}
return 0;
}
