..F....... [DEV-2181] fixed xss in graph

1 files changed, 4 insertions, 11 deletions

diff --git a/frontends/php/graphs.php b/frontends/php/graphs.php
index 5987258d387..8ae19461b41 100644
--- a/frontends/php/graphs.php
+++ b/frontends/php/graphs.php
@@ -93,19 +93,12 @@ check_fields($fields);
 $gitems = [];
 foreach (getRequest('items', []) as $item) {
 	$gitem = json_decode($item, true);
-	if (array_key_exists('itemid', $gitem)) {
-		$gitem['itemid'] = bcadd($gitem['itemid'], 0);
-	}
-
-	if (array_key_exists('type', $gitem)) {
-		$gitem['type'] = (int) $gitem['type'];
-	}
 
-	if (array_key_exists('drawtype', $gitem)) {
-		$gitem['drawtype'] = (int) $gitem['drawtype'];
+	if ((array_key_exists('itemid', $gitem) && ctype_digit($gitem['itemid']))
+			&& (array_key_exists('type', $gitem) && ctype_digit($gitem['type']))
+			&& (array_key_exists('drawtype', $gitem) && ctype_digit($gitem['drawtype']))) {
+		$gitems[] = $gitem;
 	}
-
-	$gitems[] = $gitem;
 }
 
 $_REQUEST['items'] = $gitems;