Ignore request values that are not strings.

An array action or username no longer causes a PHP error.

publish/edit.php

@@ -64,7 +64,7 @@ Ordinary web users can:     write article
 
 $action = NULL;
 if (isset($_POST['action'])) {
-  $action = strtolower($_POST['action']);
+  $action = is_string($_POST['action']) ? strtolower($_POST['action']) : NULL;
 // We can trigger only choose and edit via GET variables.
 } else if (isset($_GET['action'])) {
   if ($_GET['action'] == 'choose') {

publish/index.php

@@ -58,7 +58,7 @@ Ordinary web users can: 		write article
 */
 
 if (isset($_POST['action']))
-  $action = strtolower($_POST['action']);
+  $action = is_string($_POST['action']) ? strtolower($_POST['action']) : NULL;
 else
   $action = NULL;
 

publish/login.php

@@ -6,13 +6,14 @@ $denied = NULL;
 $wait_minutes = 0;
 $captcha_failed = FALSE;
 $is_admin = NULL;
+$login_name = is_string($_POST['username'] ?? NULL) ? $_POST['username'] : '';
 if (isset($_SESSION['editor'])) {
   session_write_close();
   header("Location: /publish/edit");
   return;
 } else if (isset($_POST['login']) && !csrf_valid()) {
   $denied = TRUE;
-} else if (isset($_POST['login']) && ($wait = login_blocked_for((string)($_POST['username'] ?? ''))) > 0) {
+} else if (isset($_POST['login']) && ($wait = login_blocked_for($login_name)) > 0) {
   $denied = TRUE;
   $wait_minutes = (int)ceil($wait / 60);
 } else if (isset($_POST['login']) && !captcha_verify_response()) {
@@ -23,7 +24,7 @@ if (isset($_SESSION['editor'])) {
   $table = "editors";
   open_db('open');
 
-  $username = (string)($_POST['username'] ?? '');
+  $username = $login_name;
   $query = "SELECT * FROM $table WHERE username = ? LIMIT 1";
   $getid = $db->execute_query($query, array($username)) or db_fail();
   $row = $getid->fetch_assoc();