core: CVE-2025-50972 fix

Author: abolabo

public_html/core/engine/layout.php

@@ -8,14 +8,14 @@
  *   Copyright © 2011-2025 Belavier Commerce LLC
  *
  *   This source file is subject to Open Software License (OSL 3.0)
- *   License details is bundled with this package in the file LICENSE.txt.
+ *   License details are bundled with this package in the file LICENSE.txt.
  *   It is also available at this URL:
  *   <http://www.opensource.org/licenses/OSL-3.0>
  *
  *  UPGRADE NOTE:
  *    Do not edit or add to this file if you wish to upgrade AbanteCart to newer
  *    versions in the future. If you wish to customize AbanteCart for your
- *    needs please refer to http://www.AbanteCart.com for more information.
+ *    needs, please refer to http://www.AbanteCart.com for more information.
  */
 if (!defined('DIR_CORE')) {
     header('Location: static_pages/');
@@ -52,7 +52,7 @@ class ALayout
     public function __construct($registry, $template_id)
     {
         $this->registry = $registry;
-        $this->tmpl_id = $template_id;
+        $this->tmpl_id = preformatTextID($template_id);
         $this->page_id = '';
     }
 

public_html/core/init.php

@@ -1,22 +1,22 @@
 <?php
-/*------------------------------------------------------------------------------
-  $Id$
-
-  AbanteCart, Ideal OpenSource Ecommerce Solution
-  http://www.AbanteCart.com
-
-  Copyright © 2011-2022 Belavier Commerce LLC
-
-  This source file is subject to Open Software License (OSL 3.0)
-  License details is bundled with this package in the file LICENSE.txt.
-  It is also available at this URL:
-  <http://www.opensource.org/licenses/OSL-3.0>
-
- UPGRADE NOTE:
-   Do not edit or add to this file if you wish to upgrade AbanteCart to newer
-   versions in the future. If you wish to customize AbanteCart for your
-   needs please refer to http://www.AbanteCart.com for more information.
-------------------------------------------------------------------------------*/
+/*
+ *   $Id$
+ *
+ *   AbanteCart, Ideal OpenSource Ecommerce Solution
+ *   http://www.AbanteCart.com
+ *
+ *   Copyright © 2011-2025 Belavier Commerce LLC
+ *
+ *   This source file is subject to Open Software License (OSL 3.0)
+ *   License details are bundled with this package in the file LICENSE.txt.
+ *   It is also available at this URL:
+ *   <http://www.opensource.org/licenses/OSL-3.0>
+ *
+ *  UPGRADE NOTE:
+ *    Do not edit or add to this file if you wish to upgrade AbanteCart to newer
+ *    versions in the future. If you wish to customize AbanteCart for your
+ *    needs, please refer to http://www.AbanteCart.com for more information.
+ */
 
 //check minimal system requirements
 $composerJson = file_get_contents(DIR_ROOT.'/composer.json');
@@ -497,7 +497,7 @@ function clean($data)
 //check if we specify template directly
     $template = 'default';
     if (IS_ADMIN !== true && !empty($request->get['sf'])) {
-        $template = preg_replace('/[^A-Za-z0-9_]+/', '', $request->get['sf']);
+        $template = preformatTextID($request->get['sf']);
         $dir = $template.DIR_EXT_STORE.DIR_EXT_TEMPLATE.$template;
         if (in_array($template, $enabled_extensions) && is_dir(DIR_EXT.$dir)) {
             $is_valid = true;

public_html/extensions/page_builder/core/page_builder_hooks.php

@@ -5,17 +5,17 @@
  *   AbanteCart, Ideal OpenSource Ecommerce Solution
  *   http://www.AbanteCart.com
  *
- *   Copyright © 2011-2024 Belavier Commerce LLC
+ *   Copyright © 2011-2025 Belavier Commerce LLC
  *
  *   This source file is subject to Open Software License (OSL 3.0)
- *   License details is bundled with this package in the file LICENSE.txt.
+ *   License details are bundled with this package in the file LICENSE.txt.
  *   It is also available at this URL:
  *   <http://www.opensource.org/licenses/OSL-3.0>
  *
  *  UPGRADE NOTE:
  *    Do not edit or add to this file if you wish to upgrade AbanteCart to newer
  *    versions in the future. If you wish to customize AbanteCart for your
- *    needs please refer to http://www.AbanteCart.com for more information.
+ *    needs, please refer to http://www.AbanteCart.com for more information.
  */
 
 use AbanteCart\PBRender;
@@ -172,8 +172,9 @@ public function onAHook_InitEnd()
     {
         $registry = Registry::getInstance();
         if ($registry?->get('request')->get['tmpl_id']) {
-            $registry?->get('config')->set('config_storefront_template', $registry->get('request')->get['tmpl_id']);
-            $registry?->set('layout', new ALayout($registry, $registry->get('request')->get['tmpl_id']));
+            $templateTextId = preformatTextID($registry->get('request')->get['tmpl_id']);
+            $registry->get('config')->set('config_storefront_template', $templateTextId);
+            $registry->set('layout', new ALayout($registry, $templateTextId));
         }
     }
 
@@ -377,7 +378,7 @@ public function onControllerPagesDesignLayout_UpdateData()
 
         $execController = $pageData['controller'];
         if(!$keyParam) {
-            $templateTxtId = $that->request->get['tmpl_id']
+            $templateTxtId = preformatTextID($that->request->get['tmpl_id'])
                 ?: Registry::getInstance()->get('config')->get('config_storefront_template');
             $l = new ALayout(Registry::getInstance(), $templateTxtId);
             $keyParam = $l->getKeyParamByController($execController);
@@ -398,7 +399,7 @@ protected function getLayoutIdsByParameters(string $rt, string $keyParam, int $k
         $that = $this->baseObject;
         $pageId = $layoutId = null;
 
-        $templateTxtId = $that->request->get['tmpl_id']
+        $templateTxtId = preformatTextID($that->request->get['tmpl_id'])
             ?: Registry::getInstance()->get('config')->get('config_storefront_template');
         $layout = new ALayout(Registry::getInstance(), $templateTxtId);
         if(!$keyParam) {