Skip to content

Права на редактирование + экранировал вывод пользовательских строк #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
evgip merged 4 commits into from
Feb 13, 2026
Merged

Права на редактирование + экранировал вывод пользовательских строк #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c626bd3
FIX: Restrict message editing to message owner
webhealer-ru Feb 13, 2026
a685090
FIX: Improve escaping for image alt attributes
webhealer-ru Feb 13, 2026
dd07e3e
FIX: Encode facet_short_description in views
webhealer-ru Feb 13, 2026
f904e38
FIX: Escape comment_content in comments transfer view
webhealer-ru Feb 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions app/Content/Img.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ class Img
public static function image(string $file, string $alt, string $style, string $type, string $size): string
{
$imgPath = self::generateImagePath($file, $type, $size);
$alt = htmlspecialchars($alt, ENT_QUOTES, null, false);

return '<img class="' . $style . '" src="' . $imgPath . '" alt="' . $alt . '">';
}
Expand All @@ -50,6 +51,7 @@ public static function image(string $file, string $alt, string $style, string $t
public static function avatar(string $file, string $alt, string $style, string $size): string
{
$imgPath = self::generateImagePath($file, 'avatar', $size);
$alt = htmlspecialchars($alt, ENT_QUOTES, null, false);

return '<img class="' . $style . '" src="' . $imgPath . '" alt="' . $alt . '">';
}
Expand Down
4 changes: 4 additions & 0 deletions app/Controllers/MessagesController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,10 @@ public function addForma()
{
$id = Request::post('id')->asInt();
$message = MessagesModel::getMessage($id);

if (!$message || (int)$message['message_sender_id'] !== (int)$this->container->user()->id()) {
redirect('/');
}

insert(
'/_block/form/form-for-editing',
Expand Down
2 changes: 1 addition & 1 deletion resources/views/default/_block/facet/recommended-topics.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<?= htmlEncode($topic['facet_title']); ?>
</a>
<div class="mt5 text-sm max-w-md gray">
<?= $topic['facet_short_description']; ?>...
<?= htmlEncode($topic['facet_short_description'] ?? ''); ?>...
</div>
</div>
<div data-id="<?= $topic['facet_id']; ?>" data-type="facet" class="focus-id red"><?= __('app.read'); ?></div>
Expand Down
4 changes: 2 additions & 2 deletions resources/views/default/content/comments/transfer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<a href="/"><?= __('app.home'); ?></a> / <span class="gray-600"><?= __('app.move_comment'); ?>:</span>

<h2 class="m0"><?= htmlEncode($data['post']['post_title']); ?></h2>
<div class="label label-orange"><?= $data['comment']['comment_content']; ?></div>
<div class="label label-orange"><?= htmlEncode($data['comment']['comment_content']); ?></div>

<form class="max-w-md mb20" action="" accept-charset="UTF-8" method="post">
<?= $container->csrf()->field(); ?>
Expand Down Expand Up @@ -40,4 +40,4 @@
</form>
</div>
</main>
<?php endif; ?>
<?php endif; ?>
2 changes: 1 addition & 1 deletion resources/views/default/content/facets/blog-header.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,6 @@
</div>

<div class="ml15 mb15 mb-none">
<?= $data['facet']['facet_short_description']; ?>
<?= htmlEncode($data['facet']['facet_short_description'] ?? ''); ?>
</div>
</div>
4 changes: 2 additions & 2 deletions resources/views/default/content/facets/edit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,13 +79,13 @@

<fieldset>
<label for="facet_description"><?= __('app.meta_description'); ?><sup class="red">*</sup></label>
<textarea class="add max-w-md" rows="6" minlength="3" name="facet_description"><?= $fs['facet_description']; ?></textarea>
<textarea class="add max-w-md" rows="6" minlength="3" name="facet_description"><?= htmlEncode($fs['facet_description'] ?? ''); ?></textarea>
<div class="help">> 3 <?= __('app.characters'); ?></div>
</fieldset>

<fieldset>
<label for="facet_short_description"><?= __('app.short_description'); ?><sup class="red">*</sup></label>
<input minlength="11" maxlength="120" value="<?= $fs['facet_short_description']; ?>" type="text" required="" name="facet_short_description">
<input minlength="11" maxlength="120" value="<?= htmlEncode($fs['facet_short_description'] ?? ''); ?>" type="text" required="" name="facet_short_description">
<div class="help">> 3 <?= __('app.characters'); ?></div>
</fieldset>

Expand Down
2 changes: 1 addition & 1 deletion resources/views/default/content/facets/topic-header.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
</a>
<?php endif; ?>
</h1>
<div class="text-sm gray-600"><?= $topic['facet_short_description']; ?></div>
<div class="text-sm gray-600"><?= htmlEncode($topic['facet_short_description'] ?? ''); ?></div>
</div>
</div>

Expand Down
2 changes: 1 addition & 1 deletion resources/views/default/main.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
<?= Img::image($facet['facet_img'], htmlEncode($facet['facet_title']), 'img-base mr15', 'logo', 'max'); ?>
<?= htmlEncode($facet['facet_title']); ?>
</a>
<span class="gray-600 text-sm lowercase mb-none"> - <?= $facet['facet_short_description']; ?></span>
<span class="gray-600 text-sm lowercase mb-none"> - <?= htmlEncode($facet['facet_short_description'] ?? ''); ?></span>
</div>
<?php endif; ?>

Expand Down