Merge branch '3.1' into 3.2

Author: thorsten

CHANGELOG.md

@@ -38,6 +38,11 @@ This is a log of major user-visible changes in each phpMyFAQ release.
 - updated Japanese translation (Advanced Bear)
 - updated Dutch translation (Bob Coret)
 
+### phpMyFAQ v3.1.16 - 2023-07-16
+
+- fixed multiple security vulnerabilities (Thorsten)
+- fixed minor bugs (Thorsten)
+
 ### phpMyFAQ v3.1.15 - 2023-06-17
 
 - fixed minor bugs (Thorsten)

phpmyfaq/admin/api/user.php

@@ -22,6 +22,7 @@
 use phpMyFAQ\Filter;
 use phpMyFAQ\Helper\MailHelper;
 use phpMyFAQ\Permission;
+use phpMyFAQ\Report;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
@@ -94,8 +95,8 @@
                 $userObject->status = $user->getStatus();
                 $userObject->isSuperAdmin = $user->isSuperAdmin();
                 $userObject->isVisible = $user->getUserData('is_visible');
-                $userObject->displayName = $user->getUserData('display_name');
-                $userObject->userName = $user->getLogin();
+                $userObject->displayName = Report::sanitize($user->getUserData('display_name'));
+                $userObject->userName = Report::sanitize($user->getLogin());
                 $userObject->email = $user->getUserData('email');
                 $userObject->authSource = $user->getUserAuthSource();
                 $userData[] = $userObject;

phpmyfaq/admin/report.export.php

@@ -119,7 +119,8 @@
 
     $content = '';
     foreach ($text as $row) {
-        $content .= implode(';', $row);
+        $csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
+        $content .= implode(';', $csvRow);
         $content .= "\r\n";
     }
 

phpmyfaq/src/phpMyFAQ/Link.php

@@ -262,11 +262,11 @@ public function toHtmlAnchor(): string
         }
 
         if (!empty($this->tooltip)) {
-            $htmlAnchor .= sprintf(' title="%s"', addslashes($this->tooltip));
+            $htmlAnchor .= sprintf(' title="%s"', Strings::htmlentities($this->tooltip));
         }
 
         if (!empty($this->name)) {
-            $htmlAnchor .= sprintf(' name="%s"', $this->name);
+            $htmlAnchor .= sprintf(' name="%s"', Strings::htmlentities($this->name));
         } else {
             if (!empty($this->url)) {
                 $htmlAnchor .= sprintf(' href="%s"', $url);
@@ -280,10 +280,10 @@ public function toHtmlAnchor(): string
         }
         $htmlAnchor .= '>';
         if (('0' == $this->text) || (!empty($this->text))) {
-            $htmlAnchor .= $this->text;
+            $htmlAnchor .= Strings::htmlentities($this->text);
         } else {
             if (!empty($this->name)) {
-                $htmlAnchor .= $this->name;
+                $htmlAnchor .= Strings::htmlentities($this->name);
             } else {
                 $htmlAnchor .= $url;
             }

phpmyfaq/src/phpMyFAQ/Report.php

@@ -139,4 +139,18 @@ public function convertEncoding(string $outputString = ''): string
         $toBeRemoved = ['=', '+', '-', 'HYPERLINK'];
         return str_replace($toBeRemoved, '', $outputString);
     }
+
+    /**
+     * Sanitizes input to avoid CSV injection.
+     * @param string|int $value
+     * @return string
+     */
+    public static function sanitize($value): string
+    {
+        if (preg_match('/[=\+\-\@\|]/', $value)) {
+            $value = '"' . str_replace('"', '""', $value) . '"';
+        }
+
+        return $value;
+    }
 }

phpmyfaq/src/phpMyFAQ/Search/Database/Mysqli.php

@@ -48,7 +48,7 @@ public function __construct(Configuration $config)
     public function search(string $searchTerm): mixed
     {
         if (is_numeric($searchTerm) && $this->config->get('search.searchForSolutionId')) {
-            parent::search($searchTerm);
+            return parent::search($searchTerm);
         } else {
             $relevance = $this->config->get('search.enableRelevance');
             $columns = $this->getResultColumns();

tests/phpMyFAQ/ReportTest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace phpMyFAQ;
+
+use PHPUnit\Framework\TestCase;
+
+class ReportTest extends TestCase
+{
+
+    public function testSanitize(): void
+    {
+        $data = [
+            ['John Doe', 'john.doe@example.com', '12345'],
+            ['Jane Smith', 'jane.smith@example.com', '=SUM(A1:A10)'],
+        ];
+
+        $actual = [];
+
+        $expected = [
+            'John Doe,"john.doe@example.com",12345',
+            'Jane Smith,"jane.smith@example.com","=SUM(A1:A10)"'
+        ];
+
+        foreach ($data as $row) {
+            $csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
+            $actual[] = implode(',', $csvRow);
+        }
+
+        $this->assertEquals($expected, $actual);
+    }
+}