Projects/nettsiden
7
3
Fork 0
Code Issues 28 Pull Requests Activity

treewide: sanitize various user-provided inputs

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2026-07-25 20:46:21 +09:00
parent 30594b62f7
commit ffb8ed0c9d
5 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/admin/aktiviteter/index.php
+4 -3
View File
@@ -92,12 +92,13 @@ $events = array_values(array_filter(
<li>
<div class="event admin">
<div class="event-info">
<h3 class="no-chin"><?php echo $event->getName() . ' (ID: ' . $eventID . ')'; ?></h3>
<h3 class="no-chin"><?php echo htmlspecialchars($event->getName()) . ' (ID: ' . $eventID . ')'; ?></h3>
<p class="subnote">
<?php echo $event->getStart()->format('(Y-m-d H:i:s)') . ' - ' . $event->getStop()->format('(Y-m-d H:i:s)'); ?>
</p>
<?php
$Parsedown = new Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $event->getDescription()));
?>
</div>
@@ -132,9 +133,9 @@ $events = array_values(array_filter(
<h2>Filter</h2>
<form action="." method="get">
<p class="no-chin">Navn</p>
<?php echo '<input type="text" name="title" class="boxinput" value="' . $filterTitle . '">'; ?><br>
<?php echo '<input type="text" name="title" class="boxinput" value="' . htmlspecialchars($filterTitle) . '">'; ?><br>
<p class="no-chin">Organisator</p>
<?php echo '<input type="text" name="organiser" class="boxinput" value="' . $filterOrganiser . '">'; ?><br>
<?php echo '<input type="text" name="organiser" class="boxinput" value="' . htmlspecialchars($filterOrganiser) . '">'; ?><br>
<div style="margin-top: 2em;">
<input type="submit" class="btn" value="Filtrer"></input>
www/aktiviteter/index.php
+6 -5
View File
@@ -56,18 +56,18 @@ $day = (isset($_GET['day']))
<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
<?php if ($event->getURL()) { ?>
<br>
<a href="<?php echo $event->getURL(); ?>"><?php echo $event->getName(); ?></a>
<a href="<?php echo htmlspecialchars($event->getURL()); ?>"><?php echo htmlspecialchars($event->getName()); ?></a>
<?php } else { ?>
<?php echo $event->getName(); ?>
<?php echo htmlspecialchars($event->getName()); ?>
<?php } ?>
<?php if ($event->getImageURL()) { ?>
<img src="<?php echo $event->getImageURL(); ?>">
<img src="<?php echo htmlspecialchars($event->getImageURL()); ?>">
<?php } ?>
</h2>
<ul class="subtext">
<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li>
<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li>
<li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
<li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
</ul>
<?php $description = $event->getDescription(); ?>
@@ -76,6 +76,7 @@ $day = (isset($_GET['day']))
} ?>
<?php
$Parsedown = new \Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $description));
?>
</article>
www/galleri/index.php
+2 -2
View File
@@ -118,8 +118,8 @@ $imageTemplate = '
'%user' => htmlspecialchars($imguser),
'%time' => $modTime,
'%name' => htmlspecialchars($displaypath),
'%path' => $serverPath . $value,
'%thumbnail' => $serverPath . '/.thumbnails' . $value . '.png',
'%path' => htmlspecialchars($serverPath . $value),
'%thumbnail' => htmlspecialchars($serverPath . '/.thumbnails' . $value . '.png'),
'%realname' => htmlspecialchars($realname),
];
echo strtr($imageTemplate, $vars);
www/hendelser/info.php
+4 -3
View File
@@ -38,17 +38,18 @@ if (!$event) {
<em><?php echo $event->getRelativeDate(); ?></em>
<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
<br>
<?php echo $event->getName(); ?>
<?php echo htmlspecialchars($event->getName()); ?>
</h2>
<ul class="subtext">
<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li>
<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li>
<li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
<li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
</ul>
<?php $description = $event->getDescription(); ?>
<?php
$Parsedown = new Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $description));
?>
</article>
www/prosjekt/mine.php
+1 -1
View File
@@ -109,7 +109,7 @@ $projects = array_values(array_filter(
<h2>Filter</h2>
<form action="mine.php" method="get">
<p class="no-chin">Navn</p>
<?php echo '<input type="text" name="filter" class="boxinput" value="' . $filter . '">'; ?><br>
<?php echo '<input type="text" name="filter" class="boxinput" value="' . htmlspecialchars($filter) . '">'; ?><br>
<div style="margin-top: 2em;">
<input type="submit" class="btn" value="Filtrer"></input>