From 8605e2e6a5ac637ed552d9469f3dc31717b4ea3e Mon Sep 17 00:00:00 2001
From: Robin Appelman <icewind@owncloud.com>
Date: Fri, 29 Aug 2014 17:33:10 +0200
Subject: [PATCH] Explicitly cast id and validate type

---
 lib/private/eventsource.php | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/private/eventsource.php b/lib/private/eventsource.php
index 22782d677e..53947f3a2f 100644
--- a/lib/private/eventsource.php
+++ b/lib/private/eventsource.php
@@ -40,7 +40,7 @@ class OC_EventSource implements \OCP\IEventSource {
 		header('X-Accel-Buffering: no');
 		$this->fallback = isset($_GET['fallback']) and $_GET['fallback'] == 'true';
 		if ($this->fallback) {
-			$this->fallBackId = $_GET['fallback_id'];
+			$this->fallBackId = (int)$_GET['fallback_id'];
 			header("Content-Type: text/html");
 			echo str_repeat('<span></span>' . PHP_EOL, 10); //dummy data to keep IE happy
 		} else {
@@ -60,18 +60,21 @@ class OC_EventSource implements \OCP\IEventSource {
 	 * @param string $type
 	 * @param mixed $data
 	 *
+	 * @throws \BadMethodCallException
 	 * if only one parameter is given, a typeless message will be send with that parameter as data
 	 */
 	public function send($type, $data = null) {
+		if ($data and !preg_match('/^[A-Za-z0-9_]+$/', $type)) {
+			throw new BadMethodCallException('Type needs to be alphanumeric ('. $type .')');
+		}
 		$this->init();
 		if (is_null($data)) {
 			$data = $type;
 			$type = null;
 		}
 		if ($this->fallback) {
-			$fallBackId = OC_Util::sanitizeHTML($this->fallBackId);
 			$response = '<script type="text/javascript">window.parent.OC.EventSource.fallBackCallBack('
-				. $fallBackId . ',"' . $type . '",' . OCP\JSON::encode($data) . ')</script>' . PHP_EOL;
+				. $this->fallBackId . ',"' . $type . '",' . OCP\JSON::encode($data) . ')</script>' . PHP_EOL;
 			echo $response;
 		} else {
 			if ($type) {