diff --git a/app/Config/Services.php b/app/Config/Services.php
index df7c8ad08..8ababb302 100644
--- a/app/Config/Services.php
+++ b/app/Config/Services.php
@@ -3,6 +3,8 @@
namespace Config;
use CodeIgniter\Config\BaseService;
+use HTMLPurifier;
+use HTMLPurifier_Config;
/**
* Services Configuration file.
@@ -29,4 +31,22 @@ class Services extends BaseService
* return new \CodeIgniter\Example();
* }
*/
+
+ private static $htmlPurifier;
+
+ public static function htmlPurifier($getShared = true)
+ {
+ if ($getShared)
+ {
+ return static::getSharedInstance('htmlPurifier');
+ }
+
+ if (!isset(static::$htmlPurifier))
+ {
+ $config = HTMLPurifier_Config::createDefault();
+ static::$htmlPurifier = new HTMLPurifier($config);
+ }
+
+ return static::$htmlPurifier;
+ }
}
diff --git a/app/Controllers/Customers.php b/app/Controllers/Customers.php
index ef8deef35..54a1ac51b 100644
--- a/app/Controllers/Customers.php
+++ b/app/Controllers/Customers.php
@@ -87,7 +87,7 @@ class Customers extends Persons
*/
public function getSearch(): void
{
- $search = $this->request->getGet('search', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
+ $search = Services::htmlPurifier()->purify($this->request->getGet('search'));
$limit = $this->request->getGet('limit', FILTER_SANITIZE_NUMBER_INT);
$offset = $this->request->getGet('offset', FILTER_SANITIZE_NUMBER_INT);
$sort = $this->request->getGet('sort', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
diff --git a/app/Views/partial/header.php b/app/Views/partial/header.php
index fb1b8a76d..55d683695 100644
--- a/app/Views/partial/header.php
+++ b/app/Views/partial/header.php
@@ -21,11 +21,66 @@ $request = Services::request();
getGet('debug') == 'true') : ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -33,6 +88,8 @@ $request = Services::request();
+
+
diff --git a/app/Views/people/manage.php b/app/Views/people/manage.php
index 10a8a68d7..f5f5f1d9c 100644
--- a/app/Views/people/manage.php
+++ b/app/Views/people/manage.php
@@ -37,7 +37,7 @@ $(document).ready(function()