fix injection

2021-01-12 12:28:45 +01:00
parent a6a0b7e3b7
commit f7648b84dd
1 changed files with 5 additions and 1 deletions
--- a/app/Http/Controllers/MeasurementController.php
+++ b/app/Http/Controllers/MeasurementController.php
@@ -15,7 +15,11 @@ class MeasurementController extends Controller
     */
    public function get(Request $request)
    {
-        $type = $request->input('type', 'temperature');
+        $types = ['temperature','humidity','pressure'];
+
+        $type = $request->input('type', $types[0]);
+        if (!in_array($type,$types)) $type = $types[0];
+
        $q = sprintf("select time,value from bme280_value where host='balkon' and type='%s' and time > now()-1d",$type);
        $result = \InfluxDB::query($q);
        $points = $result->getPoints();