From 0bbd0fb44aaf8125e69439ba1249ada5bc0210b4 Mon Sep 17 00:00:00 2001
From: Thomas FORGIONE <thomas.forgione@gmail.com>
Date: Thu, 9 Apr 2015 10:00:15 +0200
Subject: [PATCH] Cleaning PHP (eew)

---
 stream/index.php        | 26 +-------------------------
 stream/js/Params.js.php | 39 +++++++++++++++++++++++++++++++++++++++
 stream/js/main.js       |  2 +-
 3 files changed, 41 insertions(+), 26 deletions(-)
 create mode 100644 stream/js/Params.js.php

diff --git a/stream/index.php b/stream/index.php
index cbcc214..0e4b9bd 100644
--- a/stream/index.php
+++ b/stream/index.php
@@ -21,31 +21,7 @@
         <script src="/js/CameraContainer.js"></script>
         <script src="/js/Tools.js"></script>
         <script src="/js/ProgressiveSphere.js"></script>
-        <?php
-            // Set global variables
-            $default = 5;
-            $res = null;
-            try
-            {
-                if (isset($_GET['res']))
-                {
-                    $res = intval($_GET['res']);
-                    if ($res < 1 || $res > 25)
-                    {
-                        throw new Exception('Variable res not set');
-                    }
-                }
-                else
-                {
-                    throw new Exception('Variable res not set');
-                }
-            }
-            catch (Exception $e)
-            {
-                $res = $default;
-            }
-            echo "<script>var global_array = {res: " . $res . "};</script>\n";
-        ?>
+        <script src="js/Params.js.php?<?php echo htmlentities($_SERVER['QUERY_STRING']); ?>"></script>
         <script src="js/main.js"></script>
     </body>
 </html>
diff --git a/stream/js/Params.js.php b/stream/js/Params.js.php
new file mode 100644
index 0000000..10153b6
--- /dev/null
+++ b/stream/js/Params.js.php
@@ -0,0 +1,39 @@
+<?php
+
+    // This file will generate a js script
+    header("Content-Type: text/javascript");
+
+    echo "params = {};\n";
+    echo "params.get = {};\n";
+    echo "params.post = {};\n";
+
+    // Next part is to check the value of the parameters
+    // All this is necessary, we must be sure that res is a number before
+    // generating js code, otherwise, a malicious user might inject js code
+    // For example, if we simply did
+    // echo "params.get.res = " . $_GET['res'] . ";\n";
+    // One could inject a js alert by going to
+    // http://localhost/stream?res=3;alert('toto')
+
+    // Default value, will be applied if the res variable is not correct
+    $default = 5;
+    $res = null;
+
+    try
+    {
+        // Cast res to an int and check if it's in the bounds
+        // res will be 0 if filter_var returns false
+        $res = intval(filter_var($_GET['res'], FILTER_VALIDATE_INT));
+        if ($res < 1 || $res > 25)
+        {
+            throw new Exception('Variable res not set');
+        }
+    }
+    catch (Exception $e)
+    {
+        // If an exception occur, let's just set the default value
+        $res = $default;
+    }
+
+    // And finally, generate a correct js code with no possible injection
+    echo "params.get.res = " . $res . ";\n";
diff --git a/stream/js/main.js b/stream/js/main.js
index 2b3872a..1ce57b3 100644
--- a/stream/js/main.js
+++ b/stream/js/main.js
@@ -46,7 +46,7 @@ function init() {
 
     // Load the scene
     loader = new THREE.OBJLoader();
-    sphere = new ProgessiveSphere(loader, global_array.res);
+    sphere = new ProgessiveSphere(loader, params.get.res);
 
     plane = new Plane(1000,1000);
     plane.translate(0,0,-100);