fix: add missing check on special characters for page ID

thorsten · Oct 21, 2022 · 372428d · 372428d
1 parent ec1e48c
commit 372428d
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/phpmyfaq/admin/ajax.config.php b/phpmyfaq/admin/ajax.config.php
@@ -203,8 +203,8 @@
         $entity = new MetaEntity();
 
         $entity
-            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_UNSAFE_RAW))
-            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_UNSAFE_RAW))
+            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_SANITIZE_SPECIAL_CHARS))
+            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_SANITIZE_SPECIAL_CHARS))
             ->setContent(Filter::filterInput(INPUT_GET, 'content', FILTER_SANITIZE_SPECIAL_CHARS));
 
         $metaId = $meta->add($entity);

diff --git a/phpmyfaq/admin/meta.edit.php b/phpmyfaq/admin/meta.edit.php
@@ -56,7 +56,7 @@
   <div class="form-group row">
     <label for="page_id" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_page_id'] ?></label>
     <div class="col-sm-10">
-      <input type="text" class="form-control" name="page_id" value="<?= $metaData->getPageId() ?>" required>
+      <input type="text" class="form-control" name="page_id" maxlength="48" value="<?= $metaData->getPageId() ?>" required>
     </div>
   </div>
 

diff --git a/phpmyfaq/admin/meta.php b/phpmyfaq/admin/meta.php
@@ -135,7 +135,7 @@
           <div class="form-group row">
             <label for="page_id" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_page_id'] ?></label>
             <div class="col-sm-10">
-              <input type="text" class="form-control" id="page_id" required>
+              <input type="text" class="form-control" id="page_id" maxlength="48" required>
             </div>
           </div>