From 05295d1694650cd40c409416c3deb922eb757ddc Mon Sep 17 00:00:00 2001
From: HB9HIL <fabian.berg@hb9hil.org>
Date: Sat, 17 Aug 2024 00:45:09 +0200
Subject: [PATCH] thanks to POST we can remove url_encoding and prevent issues
 here

---
 application/controllers/User.php | 2 +-
 application/views/user/main.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/application/controllers/User.php b/application/controllers/User.php
index f948ee3f2..1800ae71d 100644
--- a/application/controllers/User.php
+++ b/application/controllers/User.php
@@ -1185,7 +1185,7 @@ class User extends CI_Controller {
 		}
 
 		// decrypt the hash
-		$user_id = $this->encryption->decrypt(urldecode($this->input->post('hash', TRUE) ?? ''));
+		$user_id = $this->encryption->decrypt($this->input->post('hash', TRUE) ?? '');
 
 		// make sure the user_id is a number
 		if (!is_numeric($user_id)) {
diff --git a/application/views/user/main.php b/application/views/user/main.php
index 9ee3f38e0..5f93b2a80 100644
--- a/application/views/user/main.php
+++ b/application/views/user/main.php
@@ -101,7 +101,7 @@
 								<?php
 								if ($session_uid != $row->user_id) { ?>
 								<form action="<?php echo site_url('user/impersonate'); ?>" method="post" style="display:inline;">
-									<input type="hidden" name="hash" value="<?php echo urlencode($this->encryption->encrypt($row->user_id)); ?>">
+									<input type="hidden" name="hash" value="<?php echo $this->encryption->encrypt($row->user_id); ?>">
 									<button type="submit" class="btn btn-info btn-sm"><i class="fas fa-people-arrows"></i></button>
 								</form>
 								<?php }