Lesson 17 module API forwarding to error clear variables

I have succeeded to pass parameter value to error action.

Here the sample code

<?php
 
class apiActions extends sfActions
{
  public function preExecute()
  {
    sfConfig::set('sf_web_debug', false);
  }
 
  public function executeIndex()
  {
    $user = $this->authenticateUser();
    if (!$user)
    {
     $this->getRequest()->setParameter('error_code', 1);
     $this->getRequest()->setParameter('error_message', 'login failed');
     $this->forward('api', 'error');
    }
    // do some stuff
  }
 
  private function authenticateUser()
  {
    if (isset($_SERVER['PHP_AUTH_USER']))
    {
      if ($user = UserPeer::getAuthenticatedUser($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']))
      {
        $this->getContext()->getUser()->signIn($user);
 
        return $user;
      }
    }
 
    header('WWW-Authenticate: Basic realm="askeet API"');
    header('HTTP/1.0 401 Unauthorized');
  }
  public function executeQuestion() 
  {
   $user = $this->authenticateUser();
   if (!$user)
   {
     $this->getRequest()->setParameter('error_code', 1);
     $this->getRequest()->setParameter('error_message', 'login failed');
     $this->forward('api', 'error');
   }
 
   if (!$this->getRequestParameter('stripped_title'))
   {
     $this->getRequest()->setParameter('error_code', 2);
     $this->getRequest()->setParameter('error_message', 'The API returns answers to a specific question. Please provide a stripped_title parameter');
     $this->forward('api', 'error');
   }
   else
   {
     // get the question
     $question = QuestionPeer::getQuestionFromTitle($this->getRequestParameter('stripped_title'));
  
     if ($question->getUserId() != $user->getId())
     {
     $this->getRequest()->setParameter('error_code', 3);
     $this->getRequest()->setParameter('error_message', 'You can only use the API for the questions you asked');
     $this->forward('api', 'error');
     }
     else
     {
       // get the answers
       $this->answers  = $question->getAnswers();
       $this->question = $question;
     }
   }
  }
  public function executeError()
  {
   $this->error_code = $this->getRequestParameter('error_code');
   $this->error_message = $this->getRequestParameter('error_message');
  }
}
 
?>

Imagine this code:

public function executeVerySecureAction()
{
  if ($this->getRequestParameter('password') == 'imho')
  {
    $this->activated = true;
  }
}

... now, some bad developer in your workgroup could exploit your action like this:

public function executeParasite()
{
  $this->activated = true;
  $this->forward('module', 'verySecureAction');
}

So, the best approach is, as it is, to pass "inter-modular" variables in the request parameter holder.

The wrong code is written on lesson 17 of Askeet and doesn't work. The fix is only a suggestion that I found out.

because this is minor, we will not fix askeet in favor of the new Jobeet Tutorial