Only allow explicitly known order types through

diff --git a/src/Module/BaseApi.php b/src/Module/BaseApi.php
index bfcb95eb2ed2dab56cd7e18051c9bca976c22720..2be5c246a2aee5e8be305f652a8d57791b935677 100644 (file)
--- a/src/Module/BaseApi.php
+++ b/src/Module/BaseApi.php
@@ -129,7 +129,18 @@ class BaseApi extends BaseModule
                                $condition = DBA::mergeConditions($condition, ["`uri-id` > ?", intval($request['min_id'])]);
                        }
                } else {
-                       $order_field = $requested_order;
+                       switch ($requested_order) {
+                               case TimelineOrderByTypes::RECEIVED:
+                               case TimelineOrderByTypes::CHANGED:
+                               case TimelineOrderByTypes::EDITED:
+                               case TimelineOrderByTypes::CREATED:
+                               case TimelineOrderByTypes::COMMENTED:
+                                       $order_field = $requested_order;
+                                       break;
+                               default:
+                                       throw new \Exception("Unrecognized request order: $requested_order");
+                       }
+
                        if (!empty($request['max_id'])) {
                                $condition = DBA::mergeConditions($condition, ["`$order_field` < ?", DateTimeFormat::convert($request['max_id'], DateTimeFormat::MYSQL)]);
                        }