From 7ba6fe9c4227541b02d82cc6e32f4c2da4f6574a Mon Sep 17 00:00:00 2001
From: CauseFX <causefx@me.com>
Date: Mon, 28 Jun 2021 13:51:38 -0700
Subject: [PATCH] validate data on unused API endpoint

---
 api/index.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/api/index.php b/api/index.php
index 3cddb389f..f3fb691cb 100644
--- a/api/index.php
+++ b/api/index.php
@@ -1,10 +1,17 @@
 <?php
 reset($_GET);
 $function = (key($_GET) ? str_replace("/", "_", key($_GET)) : false);
+function validateData($data)
+{
+	$data = trim($data);
+	$data = stripslashes($data);
+	return htmlspecialchars($data);
+}
+
 switch ($function) {
 	case 'v1_auth':
 		$group = ($_GET['group']) ?? 0;
-		header('Location: v2/auth?group=' . $group);
+		header('Location: v2/auth?group=' . validateData($group));
 		exit;
 	default:
 		// Forward everything to v2 api
@@ -12,4 +19,4 @@
 		$result['statusText'] = "Please Use api/v2";
 		break;
 }
-header('Location: v2/');
+header('Location: v2/');
\ No newline at end of file