Merge pull request #119 from wikimedia/fix-crop

Fix crop URL parameter sanitization
wikimedia · Nov 28, 2023 · 7ba3b50 · 7ba3b50
2 parents 14e1b9e + 37cbd16
commit 7ba3b50
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/Controller/OcrController.php b/src/Controller/OcrController.php
@@ -113,7 +113,10 @@ private function setup(): void {
 		static::$params['langs'] = $this->getLangs( $this->request );
 		static::$params['image_hosts'] = $this->engine->getImageHosts();
 		$crop = $this->request->query->get( 'crop' );
-		if ( !is_array( $crop ) ) {
+		if ( !is_array( $crop )
+			|| isset( $crop['width'] ) && !$crop['width']
+			|| isset( $crop['height'] ) && !$crop['height']
+		) {
 			$crop = [];
 		}
 		static::$params['crop'] = array_map( 'intval', $crop );