monstra-cms / monstra

THIS PROJECT IS NOT SUPPORTED ANYMORE! Check FLEXTYPE.ORG
http://flextype.org
MIT License
396 stars 123 forks source link

Check for is_string() before calling trim() on sanitizeURL() #421

Open GundamDX opened 7 years ago

GundamDX commented 7 years ago

https://github.com/monstra-cms/monstra/blob/dev/engine/Security.php#L176

If the url contains the following query ?test[]=123&test[]=abc

this will throw the warning because the variable "test" will be an array and will cause an error message. I suggest we check if the variable is a string before calling trim($url).