mirror of
https://github.com/ellite/Wallos.git
synced 2026-07-31 10:16:03 -04:00
800241a265
Raw CRLF in subscription name/notes/url passes through validate() untouched (it only escapes HTML metacharacters) and was interpolated directly into .ics VEVENT properties, letting an unescaped newline terminate the current property and inject arbitrary calendar events. Adds includes/ical_helper.php::icalEscape() (RFC 5545 value escaping) and applies it to every user-controlled value embedded in both iCal export endpoints, rather than stripping newlines in the shared validate() sanitizer (which would break legitimate multi-line notes used elsewhere in the app).