Enhanced parameter validation for quick reply actions

diff --git a/wcfsetup/install/files/lib/data/IMessageQuickReplyParametersAction.class.php b/wcfsetup/install/files/lib/data/IMessageQuickReplyParametersAction.class.php
new file mode 100644 (file)
index 0000000..d40e166
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/IMessageQuickReplyParametersAction.class.php
@@ -0,0 +1,22 @@
+<?php
+namespace wcf\data;
+
+/**
+ * Default interface for actions implementing quick reply with parameter validation.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2018 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     com.woltlab.wcf
+ * @subpackage  data
+ * @category    Community Framework
+ */
+interface IMessageQuickReplyParametersAction extends IMessageQuickReplyAction {
+       /**
+        * Returns the list of allowed data parameters for the 'quickReply' action. The
+        * 'message' key is permitted by default.
+        * 
+        * @return      string[]
+        */
+       public function getAllowedQuickReplyParameters();
+}

diff --git a/wcfsetup/install/files/lib/system/message/QuickReplyManager.class.php b/wcfsetup/install/files/lib/system/message/QuickReplyManager.class.php
index 995512c43248bd4bda6b7e68649f2083901dc666..e0bdf444e74d0b9d29075757a96913d6200e3ae6 100644 (file)
--- a/wcfsetup/install/files/lib/system/message/QuickReplyManager.class.php
+++ b/wcfsetup/install/files/lib/system/message/QuickReplyManager.class.php
@@ -4,6 +4,7 @@ use wcf\data\DatabaseObjectDecorator;
 use wcf\data\IAttachmentMessageQuickReplyAction;
 use wcf\data\IMessage;
 use wcf\data\IMessageQuickReplyAction;
+use wcf\data\IMessageQuickReplyParametersAction;
 use wcf\system\bbcode\PreParser;
 use wcf\system\event\EventHandler;
 use wcf\system\exception\SystemException;
@@ -155,6 +156,23 @@ class QuickReplyManager extends SingletonFactory {
                        unset($parameters['data']['tmpHash']);
                }
                
+               $allowedDataParameters = array('message');
+               if ($object instanceof IMessageQuickReplyParametersAction) {
+                       $allowedDataParameters = array_merge($allowedDataParameters, $object->getAllowedQuickReplyParameters());
+               }
+               $eventParameters = array(
+                       'allowedDataParameters' => $allowedDataParameters,
+                       'object' => $object
+               );
+               EventHandler::getInstance()->fireAction($this, 'allowedDataParameters', $eventParameters);
+               $allowedDataParameters = $eventParameters['allowedDataParameters'];
+               
+               foreach ($parameters['data'] as $key => $value) {
+                       if (!in_array($key, $allowedDataParameters)) {
+                               unset($parameters['data'][$key]);
+                       }
+               }
+               
                // message settings
                $parameters['data'] = array_merge($parameters['data'], MessageFormSettingsHandler::getSettings($parameters));