gitea_admin/erp_naurua
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix MCP occurrence apostrophe escaping

Browse Source
This commit is contained in:
gitea_admin committed 2026-09-27 07:49:37 +02:00
1 parent 85834a0498
commit 8733ce6148
2 files changed
+31 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

modules/market_management/service.php
+3 -4
View File
@@ -66,7 +66,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
$tokens = preg_split('/(<\/?a\b[^>]*>|<br\s*\/?>|<\/?strong\s*>)/iu', $value, -1, PREG_SPLIT_DELIM_CAPTURE);
if ($tokens === false) {
return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
return htmlspecialchars($value, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
$result = '';
@@ -89,7 +89,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
$result .= '</a>';
$anchorOpen = false;
} else {
$result .= htmlspecialchars($token, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
$result .= htmlspecialchars($token, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
continue;
}
@@ -103,7 +103,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
$anchorOpen = true;
continue;
}
$result .= htmlspecialchars($token, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
$result .= htmlspecialchars($token, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
if ($anchorOpen) {
$result .= '</a>';
@@ -1106,7 +1106,6 @@ function market_management_get_occurrence(PDO $pdo, int $occurrenceId, bool $inc
break;
}
}
market_management_sanitize_occurrence_payload($occurrence);
$costSummary = $pdo->prepare(
'SELECT COALESCE(SUM(gross_amount), 0) AS gross_amount,
COALESCE(SUM(net_amount), 0) AS net_amount,
scripts/tests/market_management_sanitizer_test.php
+28
View File
@@ -0,0 +1,28 @@
<?php
declare(strict_types=1);
require_once __DIR__ . '/../../modules/market_management/service.php';
function fail_test(string $message): void
{
fwrite(STDERR, $message . PHP_EOL);
exit(1);
}
function assert_test(bool $condition, string $message): void
{
if (!$condition) {
fail_test($message);
}
}
$plainText = "Test 'A' & <B> \"C\"";
$sanitized = market_management_sanitize_multiline_html($plainText);
assert_test($sanitized === "Test 'A' &amp; &lt;B&gt; \"C\"", 'Plain text must preserve quotes and escape markup characters once');
$link = '<a href="https://erpnaurua.imhochrain.ch/files.php?path=Marktmanagement%2Fvertrag.pdf">Vertrag</a>';
$sanitizedLink = market_management_sanitize_multiline_html($link);
assert_test(str_contains($sanitizedLink, 'class="sg-hyperlink"'), 'Allowed links must remain links');
assert_test(str_contains($sanitizedLink, 'href="https://erpnaurua.imhochrain.ch/files.php?path=Marktmanagement%2Fvertrag.pdf"'), 'Link href must remain valid');
fwrite(STDOUT, "market_management_sanitizer_test: OK\n");