fix(hardening): replace raw $_REQUEST with input wrapper functions (#6959)

* fix(hardening): replace raw $_REQUEST with input wrapper functions

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: preserve isset semantics for display_db_errors parameter

Use isset_request_var() instead of !isempty_request_var() to match
the original isset($_REQUEST[...]) behavior. The parameter may be
present with an empty value (?display_db_errors) and should still
trigger error display.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>

Author: somethingwithproof

include/global.php

@@ -371,7 +371,7 @@
 		print $li . 'the database is running.' . $il;
 		print $li . 'the credentials in config.php are valid.' . $il;
 		print $lu . $sp;
-		if (isset($_REQUEST['display_db_errors']) && !empty($config['DATABASE_ERROR'])) {
+		if (isset_request_var('display_db_errors') && !empty($config['DATABASE_ERROR'])) {
 			print $ps . 'The following database errors occurred: ' . $ul;
 			foreach ($config['DATABASE_ERROR'] as $e) {
 				print $li . $e['Code'] . ': ' . $e['Error'] . $il;

include/global_languages.php

@@ -43,19 +43,19 @@
 
 /* Repair legacy language support */
 if (!empty($config['i18n_force_language'])) {
-	$_REQUEST['language'] = $config['i18n_force_language'];
+	set_request_var('language', $config['i18n_force_language']);
 }
 
-if (!empty($_REQUEST['language'])) {
-	$_REQUEST['language'] = repair_locale($_REQUEST['language']);
+if (!isempty_request_var('language')) {
+	set_request_var('language', repair_locale(get_request_var('language')));
 }
 
 /* determine whether or not we can support the language */
 $user_locale = '';
 
-if (!empty($_REQUEST['language']) && !empty($lang2locale[$_REQUEST['language']])) {
+if (!isempty_request_var('language') && !empty($lang2locale[get_request_var('language')])) {
 	/* user requests another language */
-	$user_locale = apply_locale($_REQUEST['language']);
+	$user_locale = apply_locale(get_request_var('language'));
 	unset($_SESSION['sess_current_date1']);
 	unset($_SESSION['sess_current_date2']);