1 files changed, 25 insertions, 10 deletions

diff --git a/apps/provisioning_api/lib/groups.php b/apps/provisioning_api/lib/groups.php
index c28db35972f..7c35caca5fd 100644
--- a/apps/provisioning_api/lib/groups.php
+++ b/apps/provisioning_api/lib/groups.php
@@ -37,14 +37,20 @@ class Groups{
 	/** @var \OCP\IUserSession */
 	private $userSession;
 
+	/** @var \OCP\IRequest */
+	private $request;
+
 	/**
 	 * @param \OCP\IGroupManager $groupManager
 	 * @param \OCP\IUserSession $userSession
+	 * @param \OCP\IRequest $request
 	 */
 	public function __construct(\OCP\IGroupManager $groupManager,
-								\OCP\IUserSession $userSession) {
+								\OCP\IUserSession $userSession,
+								\OCP\IRequest $request) {
 		$this->groupManager = $groupManager;
 		$this->userSession = $userSession;
+		$this->request = $request;
 	}
 
 	/**
@@ -54,9 +60,16 @@ class Groups{
 	 * @return OC_OCS_Result
 	 */
 	public function getGroups($parameters) {
-		$search = !empty($_GET['search']) ? $_GET['search'] : '';
-		$limit = !empty($_GET['limit']) ? $_GET['limit'] : null;
-		$offset = !empty($_GET['offset']) ? $_GET['offset'] : null;
+		$search = $this->request->getParam('search', '');
+		$limit = $this->request->getParam('limit');
+		$offset = $this->request->getParam('offset');
+
+		if ($limit !== null) {
+			$limit = (int)$limit;
+		}
+		if ($offset !== null) {
+			$offset = (int)$offset;
+		}
 
 		$groups = $this->groupManager->search($search, $limit, $offset);
 		$groups = array_map(function($group) {
@@ -80,21 +93,23 @@ class Groups{
 			return new OC_OCS_Result(null, \OCP\API::RESPOND_UNAUTHORISED);
 		}
 
+		$groupId = $parameters['groupid'];
+
 		// Check the group exists
-		if(!$this->groupManager->groupExists($parameters['groupid'])) {
+		if(!$this->groupManager->groupExists($groupId)) {
 			return new OC_OCS_Result(null, \OCP\API::RESPOND_NOT_FOUND, 'The requested group could not be found');
 		}
 
 		$isSubadminOfGroup = false;
-		$targetGroupObject =$this->groupManager->get($parameters['groupid']);
-		if($targetGroupObject !== null) {
-			$isSubadminOfGroup =$this->groupManager->getSubAdmin()->isSubAdminofGroup($user, $targetGroupObject);
+		$group = $this->groupManager->get($groupId);
+		if ($group !== null) {
+			$isSubadminOfGroup =$this->groupManager->getSubAdmin()->isSubAdminofGroup($user, $group);
 		}
 
 		// Check subadmin has access to this group
 		if($this->groupManager->isAdmin($user->getUID())
 		   || $isSubadminOfGroup) {
-			$users = $this->groupManager->get($parameters['groupid'])->getUsers();
+			$users = $this->groupManager->get($groupId)->getUsers();
 			$users =  array_map(function($user) {
 				/** @var IUser $user */
 				return $user->getUID();
@@ -114,7 +129,7 @@ class Groups{
 	 */
 	public function addGroup($parameters) {
 		// Validate name
-		$groupId = isset($_POST['groupid']) ? $_POST['groupid'] : '';
+		$groupId = $this->request->getParam('groupid', '');
 		if( preg_match( '/[^a-zA-Z0-9 _\.@\-]/', $groupId ) || empty($groupId)){
 			\OCP\Util::writeLog('provisioning_api', 'Attempt made to create group using invalid characters.', \OCP\Util::ERROR);
 			return new OC_OCS_Result(null, 101, 'Invalid group name');