protect columns
authorAlan <alan@roojs.com>
Wed, 15 Mar 2023 06:49:08 +0000 (14:49 +0800)
committerAlan <alan@roojs.com>
Wed, 15 Mar 2023 06:49:08 +0000 (14:49 +0800)
Pman/Roo.php

index 344bbb0..5334bbb 100644 (file)
@@ -199,7 +199,7 @@ class Pman_Roo extends Pman
         $tab = array_shift($tt);
         $x = $this->dataObject($tab);
         
-        $_columns = !empty($_REQUEST['_columns']) ? explode(',', $_REQUEST['_columns']) : false;
+        $_columns = !empty($_REQUEST['_columns']) && is_string(['_columns']) ? explode(',', $_REQUEST['_columns']) : false;
         
         if (isset( $_REQUEST['lookup'] ) && is_array($_REQUEST['lookup'] )) { // single fetch based on key/value pairs
              $this->selectSingle($x, $_REQUEST['lookup'],$_REQUEST);