Hi, sotwell. Of course, you can break the execution of preserveUrl() function with $modx->sendRedirect(), but we -- you and me -- have in mind different things. By breaking the function you will hardcode into it your interpretation that bogus array necessarily means hacking attempt, while my intention was only to assure that urlencode() function receives formally correct data.
function preserveUrl($docid = '', $alias = '', $array_values = array(), $suffix = false) {
global $modx;
$array_get = $_GET; /* ---- #1 ---- */
$urlstring = array();
unset($array_get["id"]);
unset($array_get["q"]);
$array_url = array_merge($array_get, $array_values);
foreach ($array_url as $name => $value) {
if (!is_null($value)) {
#$urlstring[] = urlencode($name) . '=' . urlencode($value); /* ---- #2 ---- */
# #### rewritten by Aleksander Maksymiuk, http://setpro.net.pl/
$urlstring[] = urlencode($name) . '=' . urlencode((is_array($value) ? implode('', $value) : $value));
# rewritten by Aleksander Maksymiuk ####
}
}
$url = join('&',$urlstring);
if ($suffix) {
if (empty($url)) { $url = "?"; }
else { $url .= "&"; }
}
return $modx->makeUrl($docid, $alias, $url);
}
Author of this function takes in line #1 the data from doubtful source ($_GET[]) and in line #2 is not careful enough about its correctness what leads to parse error. My intention was only to avoid this error. The distinction whether it is hacking attemp or not, IMHO, might be and should be done in more appropriate phase/stage (as I described above).
☆ A M B ☆
