From 126a49185229f248eae8c485b3e16e029ebcb353 Mon Sep 17 00:00:00 2001 From: polo Date: Fri, 23 Oct 2026 23:29:59 +0200 Subject: =?UTF-8?q?audit=20claude=20code=201,=20validation=20formulaire=20?= =?UTF-8?q?toujours=20ok,=20=C3=A9chappement=20dans=20URL,=20quelques=20ht?= =?UTF-8?q?mlspecialchars=20manquants,=20fonction=20Security::validateURL?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/Controller/HeadFootController.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src/Controller/HeadFootController.php') diff --git a/src/Controller/HeadFootController.php b/src/Controller/HeadFootController.php index e39c07b..2bf210e 100644 --- a/src/Controller/HeadFootController.php +++ b/src/Controller/HeadFootController.php @@ -28,14 +28,19 @@ class HeadFootController $node_data = $model->getNode()->getNodeData(); // liens réseaux sociaux + $link = trim($json['new_text'] ?? ''); // trim n'aime pas recevoir un NULL if(in_array($params_array[1], NodeData::$social_networks)){ + if($link !== '' && !Security::validateURL($link)){ + return new JsonResponse(['success' => false, 'error' => 'invalid_url']); + } + $social = $node_data->getData()['social'] ?? []; - $social[$params_array[1]] = $json['new_text']; + $social[$params_array[1]] = $link; $node_data->updateData('social', $social); } // autres textes else{ - $node_data->updateData($params_array[1], $json['new_text']); // $params_array[1] n'est pas contrôlé + $node_data->updateData($params_array[1], $link); // $params_array[1] n'est pas contrôlé } $entityManager->flush(); -- cgit v1.2.3