From f5ba1709ebd55c1ca56ccbacc43b1469f97d77dd Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Fri, 7 Aug 2026 20:30:02 +0400
Subject: [PATCH] fix(security): sanitize filenames and escape logo path in
 config (#4630)

* fix(security): sanitize filenames and escape logo path in config

- Sanitize uploaded filename in Config.php via preg_replace, strip
  chars outside [a-zA-Z0-9_-] before storing raw_name
- Escape $logo_src with esc(..., 'attr') in info_config.php view to
  prevent XSS via crafted logo path/filename

Prevents stored XSS and path traversal from unsanitized filenames
used in config uploads.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>

* fix(config): sanitize uploaded config filenames

Replace inline regex filename sanitization with sanitize_filename()
helper to prevent path traversal via crafted upload filenames.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>

---------

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>
Co-authored-by: Travis Garrison <travis@chiraqbookstore.com>
---
 app/Controllers/Config.php        | 3 ++-
 app/Views/configs/info_config.php | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/Controllers/Config.php b/app/Controllers/Config.php
index 1e4c1ead3..5c0b33171 100644
--- a/app/Controllers/Config.php
+++ b/app/Controllers/Config.php
@@ -349,10 +349,11 @@ class Config extends Secure_Controller
 
         $filename = $file->getClientName();
         $info = pathinfo($filename);
+        helper('security');
 
         $file_info = [
             'orig_name' => $filename,
-            'raw_name'  => $info['filename'],
+            'raw_name'  => sanitize_filename($info['filename']),
             'file_ext'  => $file->guessExtension()
         ];
 
diff --git a/app/Views/configs/info_config.php b/app/Views/configs/info_config.php
index 54c121d17..1a7051844 100644
--- a/app/Views/configs/info_config.php
+++ b/app/Views/configs/info_config.php
@@ -36,7 +36,7 @@
                     <div class="fileinput <?= $logo_exists ? 'fileinput-exists' : 'fileinput-new' ?>" data-provides="fileinput">
                         <div class="fileinput-new thumbnail" style="width: 200px; height: 200px;"></div>
                         <div class="fileinput-preview fileinput-exists thumbnail" style="max-width: 200px; max-height: 200px;">
-                            <img data-src="holder.js/100%x100%" alt="<?= esc(lang('Config.company_logo')) ?>" src="<?= $logo_src ?>" style="max-height: 100%; max-width: 100%;">
+                            <img data-src="holder.js/100%x100%" alt="<?= esc(lang('Config.company_logo')) ?>" src="<?= esc($logo_src, 'attr') ?>" style="max-height: 100%; max-width: 100%;">
                         </div>
                         <div>
                             <span class="btn btn-default btn-sm btn-file">