Fix crop URL parameter sanitization

Crop width and height can be empty strings, which were being turned into 0.
wikimedia · Nov 27, 2023 · 37cbd16 · 37cbd16
1 parent d01e314
commit 37cbd16
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/Controller/OcrController.php b/src/Controller/OcrController.php
@@ -113,7 +113,10 @@ private function setup(): void {
 		static::$params['langs'] = $this->getLangs( $this->request );
 		static::$params['image_hosts'] = $this->engine->getImageHosts();
 		$crop = $this->request->query->get( 'crop' );
-		if ( !is_array( $crop ) ) {
+		if ( !is_array( $crop )
+			|| isset( $crop['width'] ) && !$crop['width']
+			|| isset( $crop['height'] ) && !$crop['height']
+		) {
 			$crop = [];
 		}
 		static::$params['crop'] = array_map( 'intval', $crop );