Projects/nettsiden
7
3
Fork 0
Code Issues 28 Pull Requests Activity

treewide: sanitize various user-provided inputs

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2026-07-25 20:46:21 +09:00
parent 30594b62f7
commit ffb8ed0c9d
5 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/admin/aktiviteter/index.php
+4 -3
View File
@@ -92,12 +92,13 @@ $events = array_values(array_filter(
<li> <li>
<div class="event admin"> <div class="event admin">
<div class="event-info"> <div class="event-info">
<h3 class="no-chin"><?php echo $event->getName() . ' (ID: ' . $eventID . ')'; ?></h3> <h3 class="no-chin"><?php echo htmlspecialchars($event->getName()) . ' (ID: ' . $eventID . ')'; ?></h3>
<p class="subnote"> <p class="subnote">
<?php echo $event->getStart()->format('(Y-m-d H:i:s)') . ' - ' . $event->getStop()->format('(Y-m-d H:i:s)'); ?> <?php echo $event->getStart()->format('(Y-m-d H:i:s)') . ' - ' . $event->getStop()->format('(Y-m-d H:i:s)'); ?>
</p> </p>
<?php <?php
$Parsedown = new Parsedown(); $Parsedown = new Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $event->getDescription())); echo $Parsedown->text(implode("\n", $event->getDescription()));
?> ?>
</div> </div>
@@ -132,9 +133,9 @@ $events = array_values(array_filter(
<h2>Filter</h2> <h2>Filter</h2>
<form action="." method="get"> <form action="." method="get">
<p class="no-chin">Navn</p> <p class="no-chin">Navn</p>
<?php echo '<input type="text" name="title" class="boxinput" value="' . $filterTitle . '">'; ?><br> <?php echo '<input type="text" name="title" class="boxinput" value="' . htmlspecialchars($filterTitle) . '">'; ?><br>
<p class="no-chin">Organisator</p> <p class="no-chin">Organisator</p>
<?php echo '<input type="text" name="organiser" class="boxinput" value="' . $filterOrganiser . '">'; ?><br> <?php echo '<input type="text" name="organiser" class="boxinput" value="' . htmlspecialchars($filterOrganiser) . '">'; ?><br>
<div style="margin-top: 2em;"> <div style="margin-top: 2em;">
<input type="submit" class="btn" value="Filtrer"></input> <input type="submit" class="btn" value="Filtrer"></input>
www/aktiviteter/index.php
+6 -5
View File
@@ -56,18 +56,18 @@ $day = (isset($_GET['day']))
<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?> <?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
<?php if ($event->getURL()) { ?> <?php if ($event->getURL()) { ?>
<br> <br>
<a href="<?php echo $event->getURL(); ?>"><?php echo $event->getName(); ?></a> <a href="<?php echo htmlspecialchars($event->getURL()); ?>"><?php echo htmlspecialchars($event->getName()); ?></a>
<?php } else { ?> <?php } else { ?>
<?php echo $event->getName(); ?> <?php echo htmlspecialchars($event->getName()); ?>
<?php } ?> <?php } ?>
<?php if ($event->getImageURL()) { ?> <?php if ($event->getImageURL()) { ?>
<img src="<?php echo $event->getImageURL(); ?>"> <img src="<?php echo htmlspecialchars($event->getImageURL()); ?>">
<?php } ?> <?php } ?>
</h2> </h2>
<ul class="subtext"> <ul class="subtext">
<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li> <li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li> <li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li> <li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
</ul> </ul>
<?php $description = $event->getDescription(); ?> <?php $description = $event->getDescription(); ?>
@@ -76,6 +76,7 @@ $day = (isset($_GET['day']))
} ?> } ?>
<?php <?php
$Parsedown = new \Parsedown(); $Parsedown = new \Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $description)); echo $Parsedown->text(implode("\n", $description));
?> ?>
</article> </article>
www/galleri/index.php
+2 -2
View File
@@ -118,8 +118,8 @@ $imageTemplate = '
'%user' => htmlspecialchars($imguser), '%user' => htmlspecialchars($imguser),
'%time' => $modTime, '%time' => $modTime,
'%name' => htmlspecialchars($displaypath), '%name' => htmlspecialchars($displaypath),
'%path' => $serverPath . $value, '%path' => htmlspecialchars($serverPath . $value),
'%thumbnail' => $serverPath . '/.thumbnails' . $value . '.png', '%thumbnail' => htmlspecialchars($serverPath . '/.thumbnails' . $value . '.png'),
'%realname' => htmlspecialchars($realname), '%realname' => htmlspecialchars($realname),
]; ];
echo strtr($imageTemplate, $vars); echo strtr($imageTemplate, $vars);
www/hendelser/info.php
+4 -3
View File
@@ -38,17 +38,18 @@ if (!$event) {
<em><?php echo $event->getRelativeDate(); ?></em> <em><?php echo $event->getRelativeDate(); ?></em>
<?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?> <?php if (Agenda::isToday($event->getStart())) { ?></strong><?php } ?>
<br> <br>
<?php echo $event->getName(); ?> <?php echo htmlspecialchars($event->getName()); ?>
</h2> </h2>
<ul class="subtext"> <ul class="subtext">
<li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li> <li>Tid: <strong><?php echo Agenda::getFormattedDate($event->getStart()); ?></strong></li>
<li>Sted: <strong><?php echo $event->getLocation(); ?></strong></li> <li>Sted: <strong><?php echo htmlspecialchars($event->getLocation()); ?></strong></li>
<li>Arrangør: <strong><?php echo $event->getOrganiser(); ?></strong></li> <li>Arrangør: <strong><?php echo htmlspecialchars($event->getOrganiser()); ?></strong></li>
</ul> </ul>
<?php $description = $event->getDescription(); ?> <?php $description = $event->getDescription(); ?>
<?php <?php
$Parsedown = new Parsedown(); $Parsedown = new Parsedown();
$Parsedown->setSafeMode(true);
echo $Parsedown->text(implode("\n", $description)); echo $Parsedown->text(implode("\n", $description));
?> ?>
</article> </article>
www/prosjekt/mine.php
+1 -1
View File
@@ -109,7 +109,7 @@ $projects = array_values(array_filter(
<h2>Filter</h2> <h2>Filter</h2>
<form action="mine.php" method="get"> <form action="mine.php" method="get">
<p class="no-chin">Navn</p> <p class="no-chin">Navn</p>
<?php echo '<input type="text" name="filter" class="boxinput" value="' . $filter . '">'; ?><br> <?php echo '<input type="text" name="filter" class="boxinput" value="' . htmlspecialchars($filter) . '">'; ?><br>
<div style="margin-top: 2em;"> <div style="margin-top: 2em;">
<input type="submit" class="btn" value="Filtrer"></input> <input type="submit" class="btn" value="Filtrer"></input>