From 14248edc06eef8c3a094bc1d357af8a05f674e16 Mon Sep 17 00:00:00 2001 From: objecttothis Date: Tue, 21 May 2024 11:07:00 +0400 Subject: [PATCH] HTMLPurifier filtering - Replaced == with === to avoid type juggling - Removed unneeded TODO - Added HTMLPurifier to composer.json - Added Service to allow singleton instance of purifier. - Implemented use in Customer Controller Search function. Signed-off-by: objecttothis --- app/Config/Services.php | 20 +++++++++++ app/Controllers/Customers.php | 2 +- app/Views/partial/header.php | 57 +++++++++++++++++++++++++++++++ app/Views/people/manage.php | 2 +- composer.json | 1 + composer.lock | 63 ++++++++++++++++++++++++++++++++++- 6 files changed, 142 insertions(+), 3 deletions(-) diff --git a/app/Config/Services.php b/app/Config/Services.php index df7c8ad08..8ababb302 100644 --- a/app/Config/Services.php +++ b/app/Config/Services.php @@ -3,6 +3,8 @@ namespace Config; use CodeIgniter\Config\BaseService; +use HTMLPurifier; +use HTMLPurifier_Config; /** * Services Configuration file. @@ -29,4 +31,22 @@ class Services extends BaseService * return new \CodeIgniter\Example(); * } */ + + private static $htmlPurifier; + + public static function htmlPurifier($getShared = true) + { + if ($getShared) + { + return static::getSharedInstance('htmlPurifier'); + } + + if (!isset(static::$htmlPurifier)) + { + $config = HTMLPurifier_Config::createDefault(); + static::$htmlPurifier = new HTMLPurifier($config); + } + + return static::$htmlPurifier; + } } diff --git a/app/Controllers/Customers.php b/app/Controllers/Customers.php index ef8deef35..54a1ac51b 100644 --- a/app/Controllers/Customers.php +++ b/app/Controllers/Customers.php @@ -87,7 +87,7 @@ class Customers extends Persons */ public function getSearch(): void { - $search = $this->request->getGet('search', FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $search = Services::htmlPurifier()->purify($this->request->getGet('search')); $limit = $this->request->getGet('limit', FILTER_SANITIZE_NUMBER_INT); $offset = $this->request->getGet('offset', FILTER_SANITIZE_NUMBER_INT); $sort = $this->request->getGet('sort', FILTER_SANITIZE_FULL_SPECIAL_CHARS); diff --git a/app/Views/partial/header.php b/app/Views/partial/header.php index fb1b8a76d..55d683695 100644 --- a/app/Views/partial/header.php +++ b/app/Views/partial/header.php @@ -21,11 +21,66 @@ $request = Services::request(); getGet('debug') == 'true') : ?> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -33,6 +88,8 @@ $request = Services::request(); + + diff --git a/app/Views/people/manage.php b/app/Views/people/manage.php index 10a8a68d7..f5f5f1d9c 100644 --- a/app/Views/people/manage.php +++ b/app/Views/people/manage.php @@ -37,7 +37,7 @@ $(document).ready(function()