fix: only URLs should be allowed

thorsten · Aug 30, 2023 · e923695 · e923695
1 parent 66f1588
commit e923695
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/phpmyfaq/admin/ajax.config_list.php b/phpmyfaq/admin/ajax.config_list.php
@@ -86,8 +86,8 @@ function renderInputForm($key, $type)
                     $type = 'url';
                     break;
                 default:
-                  $type = 'text';
-                  break;
+                    $type = 'text';
+                    break;
             }
 
             printf(

diff --git a/phpmyfaq/admin/configuration.php b/phpmyfaq/admin/configuration.php
@@ -58,6 +58,13 @@
             unset($editData['edit']['main.currentVersion']); // don't update the version number
         }
 
+        if (
+            isset($editData['edit']['main.referenceURL']) &&
+            is_null(Filter::filterVar($editData['edit']['main.referenceURL'], FILTER_VALIDATE_URL))
+        ) {
+            unset($editData['edit']['main.referenceURL']);
+        }
+
         foreach ($editData['edit'] as $key => $value) {
             // Remove forbidden characters
             $newConfigValues[$key] = str_replace($forbiddenValues, '', $value);