From 5061e5841be6c218ebb0de0cbf7b7f195dc46d19 Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Tue, 14 Feb 2023 19:03:58 +0100
Subject: [PATCH] fix: added missing validation of URLs and conversion to HTML
 entities

---
 phpmyfaq/admin/news.php        | 18 ++++++++++--------
 phpmyfaq/src/phpMyFAQ/News.php |  2 +-
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/phpmyfaq/admin/news.php b/phpmyfaq/admin/news.php
index 3cae41841c..0c76cc8e86 100644
--- a/phpmyfaq/admin/news.php
+++ b/phpmyfaq/admin/news.php
@@ -47,7 +47,8 @@
 
         <div class="row">
             <div class="col-12">
-                <form id="faqEditor" name="faqEditor" action="?action=save-news" method="post" novalidate>
+                <form id="faqEditor" name="faqEditor" action="?action=save-news" method="post" class="needs-validation"
+                      novalidate>
 
                     <div class="form-group row">
                         <label class="col-3 col-form-label" for="newsheader">
@@ -112,7 +113,7 @@
                     <div class="form-group row">
                         <label class="col-3 col-form-label" for="link"><?= $PMF_LANG['ad_news_link_url'] ?></label>
                         <div class="col-9">
-                            <input class="form-control" type="text" name="link" id="link"
+                            <input class="form-control" type="url" name="link" id="link"
                             placeholder="http://www.example.com/">
                         </div>
                     </div>
@@ -256,7 +257,8 @@
 
         <div class="row">
             <div class="col-12">
-                <form  action="?action=update-news" method="post" accept-charset="utf-8">
+                <form action="?action=update-news" method="post" accept-charset="utf-8" class="needs-validation"
+                      novalidate>
                     <input type="hidden" name="id" value="<?= $newsData['id'] ?>">
 
                     <div class="form-group row">
@@ -328,7 +330,7 @@
                     <div class="form-group row">
                         <label class="col-3 col-form-label" for="link"><?= $PMF_LANG['ad_news_link_url'] ?></label>
                         <div class="col-9">
-                            <input type="text" id="link" name="link"
+                            <input type="url" id="link" name="link"
                             value="<?= Strings::htmlentities($newsData['link']) ?>" class="form-control">
                         </div>
                     </div>
@@ -449,8 +451,8 @@
     $email = Filter::filterInput(INPUT_POST, 'authorEmail', FILTER_VALIDATE_EMAIL);
     $active = Filter::filterInput(INPUT_POST, 'active', FILTER_UNSAFE_RAW);
     $comment = Filter::filterInput(INPUT_POST, 'comment', FILTER_UNSAFE_RAW);
-    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_SANITIZE_SPECIAL_CHARS);
-    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_SPECIAL_CHARS);
+    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_VALIDATE_URL);
+    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_ENCODED);
     $newsLang = Filter::filterInput(INPUT_POST, 'langTo', FILTER_UNSAFE_RAW);
     $target = Filter::filterInput(INPUT_POST, 'target', FILTER_UNSAFE_RAW);
 
@@ -500,8 +502,8 @@
     $email = Filter::filterInput(INPUT_POST, 'authorEmail', FILTER_VALIDATE_EMAIL);
     $active = Filter::filterInput(INPUT_POST, 'active', FILTER_UNSAFE_RAW);
     $comment = Filter::filterInput(INPUT_POST, 'comment', FILTER_UNSAFE_RAW);
-    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_UNSAFE_RAW);
-    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_UNSAFE_RAW);
+    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_VALIDATE_URL);
+    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_ENCODED);
     $newsLang = Filter::filterInput(INPUT_POST, 'langTo', FILTER_UNSAFE_RAW);
     $target = Filter::filterInput(INPUT_POST, 'target', FILTER_UNSAFE_RAW);
 
diff --git a/phpmyfaq/src/phpMyFAQ/News.php b/phpmyfaq/src/phpMyFAQ/News.php
index b90cc1e825..e40643562d 100644
--- a/phpmyfaq/src/phpMyFAQ/News.php
+++ b/phpmyfaq/src/phpMyFAQ/News.php
@@ -95,7 +95,7 @@ public function getNews(bool $showArchive = false, bool $active = true): string
                     $this->pmfLang['msgInfo'],
                     Strings::htmlentities($item['link']),
                     $item['target'],
-                    $item['linkTitle']
+                    Strings::htmlentities($item['linkTitle'])
                 );
             }