From ffb8ed0c9df2444727e49f16f7e43ea70184dc4b Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sat, 25 Jul 2026 20:46:21 +0900
Subject: [PATCH] treewide: sanitize various user-provided inputs

---
 www/admin/aktiviteter/index.php |  7 ++++---
 www/aktiviteter/index.php       | 11 ++++++-----
 www/galleri/index.php           |  4 ++--
 www/hendelser/info.php          |  7 ++++---
 www/prosjekt/mine.php           |  2 +-
 5 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/www/admin/aktiviteter/index.php b/www/admin/aktiviteter/index.php
index a368d7b..60adf6a 100644
--- a/www/admin/aktiviteter/index.php
+++ b/www/admin/aktiviteter/index.php
@@ -92,12 +92,13 @@ $events = array_values(array_filter(
 						<li>
 							<div class="event admin">
 								<div class="event-info">
-									<h3 class="no-chin"><?php echo $event->getName() . ' (ID: ' . $eventID . ')'; ?></h3>
+									<h3 class="no-chin"><?php echo htmlspecialchars($event->getName()) . ' (ID: ' . $eventID . ')'; ?></h3>
 									<p class="subnote">
 										<?php echo $event->getStart()->format('(Y-m-d H:i:s)') . ' - ' . $event->getStop()->format('(Y-m-d H:i:s)'); ?>
 									</p>
 									<?php
                     $Parsedown = new Parsedown();
+                    $Parsedown->setSafeMode(true);
                     echo $Parsedown->text(implode("\n", $event->getDescription()));
                   ?>
 								</div>
@@ -132,9 +133,9 @@ $events = array_values(array_filter(
 				<h2>Filter</h2>
 				<form action="." method="get">
 					<p class="no-chin">Navn</p>
-					<?php echo '<input type="text" name="title" class="boxinput" value="' . $filterTitle . '">'; ?><br>
+					<?php echo '<input type="text" name="title" class="boxinput" value="' . htmlspecialchars($filterTitle) . '">'; ?><br>
 					<p class="no-chin">Organisator</p>
-					<?php echo '<input type="text" name="organiser" class="boxinput" value="' . $filterOrganiser . '">'; ?><br>
+					<?php echo '<input type="text" name="organiser" class="boxinput" value="' . htmlspecialchars($filterOrganiser) . '">'; ?><br>
 
 					<div style="margin-top: 2em;">
 						<input type="submit" class="btn" value="Filtrer"></input>
diff --git a/www/aktiviteter/index.php b/www/aktiviteter/index.php
index 704e234..216b61d 100644
--- a/www/aktiviteter/index.php
+++ b/www/aktiviteter/index.php
@@ -56,18 +56,18 @@ $day = (isset($_GET['day']))
 				<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
 				<?php if ($event->getURL()) { ?>
 				<br>
-				<a href="<?php echo $event->getURL(); ?>"><?php echo $event->getName(); ?></a>
+				<a href="<?php echo htmlspecialchars($event->getURL()); ?>"><?php echo htmlspecialchars($event->getName()); ?></a>
 				<?php } else { ?>
-				<?php echo $event->getName(); ?>
+				<?php echo htmlspecialchars($event->getName()); ?>
 				<?php } ?>
 				<?php if ($event->getImageURL()) { ?>
-				<img src="<?php echo $event->getImageURL(); ?>">
+				<img src="<?php echo htmlspecialchars($event->getImageURL()); ?>">
 				<?php } ?>
 			</h2>
 			<ul class="subtext">
 				<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
-				<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li>
-				<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li>
+				<li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
+				<li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
 			</ul>
 
 			<?php $description = $event->getDescription(); ?>
@@ -76,6 +76,7 @@ $day = (isset($_GET['day']))
 			} ?>
 			<?php
         $Parsedown = new \Parsedown();
+        $Parsedown->setSafeMode(true);
         echo $Parsedown->text(implode("\n", $description));
       ?>
 		</article>
diff --git a/www/galleri/index.php b/www/galleri/index.php
index e781703..9fe13f6 100644
--- a/www/galleri/index.php
+++ b/www/galleri/index.php
@@ -118,8 +118,8 @@ $imageTemplate = '
             '%user'         =>  htmlspecialchars($imguser),
             '%time'         =>  $modTime,
             '%name'         =>  htmlspecialchars($displaypath),
-            '%path'         =>  $serverPath . $value,
-            '%thumbnail'    =>  $serverPath . '/.thumbnails' . $value . '.png',
+            '%path'         =>  htmlspecialchars($serverPath . $value),
+            '%thumbnail'    =>  htmlspecialchars($serverPath . '/.thumbnails' . $value . '.png'),
             '%realname'     =>  htmlspecialchars($realname),
           ];
           echo strtr($imageTemplate, $vars);
diff --git a/www/hendelser/info.php b/www/hendelser/info.php
index 17f217b..1dba508 100644
--- a/www/hendelser/info.php
+++ b/www/hendelser/info.php
@@ -38,17 +38,18 @@ if (!$event) {
 				<em><?php echo $event->getRelativeDate(); ?></em>
 				<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
 				<br>
-				<?php echo $event->getName(); ?>
+				<?php echo htmlspecialchars($event->getName()); ?>
 			</h2>
 			<ul class="subtext">
 				<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
-				<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li>
-				<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li>
+				<li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
+				<li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
 			</ul>
 
 			<?php $description = $event->getDescription(); ?>
 			<?php
         $Parsedown = new Parsedown();
+        $Parsedown->setSafeMode(true);
         echo $Parsedown->text(implode("\n", $description));
       ?>
 		</article>
diff --git a/www/prosjekt/mine.php b/www/prosjekt/mine.php
index 0e31994..cfab0c5 100644
--- a/www/prosjekt/mine.php
+++ b/www/prosjekt/mine.php
@@ -109,7 +109,7 @@ $projects = array_values(array_filter(
 			<h2>Filter</h2>
 			<form action="mine.php" method="get">
 				<p class="no-chin">Navn</p>
-				<?php echo '<input type="text" name="filter" class="boxinput" value="' . $filter . '">'; ?><br>
+				<?php echo '<input type="text" name="filter" class="boxinput" value="' . htmlspecialchars($filter) . '">'; ?><br>
 
 				<div style="margin-top: 2em;">
 					<input type="submit" class="btn" value="Filtrer"></input>