From 21454fcf85c9d6e10a2f5461147821f187e1098f Mon Sep 17 00:00:00 2001
From: int2001 <joerg@dj7nt.de>
Date: Sun, 10 Mar 2024 13:07:10 +0000
Subject: [PATCH 1/2] More sanitizing

---
 assets/js/sections/satellite.js | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/assets/js/sections/satellite.js b/assets/js/sections/satellite.js
index c071c1f92..4723dae2a 100644
--- a/assets/js/sections/satellite.js
+++ b/assets/js/sections/satellite.js
@@ -15,11 +15,22 @@ $(document).ready(function () {
 		}
 	});
 
+	$(document).on('click','.deleteSatmode', function (e) {
+		deleteSatmode(e.currentTarget.id,e.currentTarget.attributes.infotext.value);
+	});
+
 	$(document).on('click','.editSatmode', function (e) {
 		editSatmode(e.currentTarget.id);
 	});
 });
 
+	function sanit(text) {
+		out = text.replace("\\"," ");
+		out = text.replace("\"","'");
+		return $("<textarea/>").text(out).html();
+	}
+
+
 function createSatelliteDialog() {
 	$.ajax({
 		url: base_url + 'index.php/satellite/create',
@@ -205,18 +216,18 @@ function restoreLine(id) {
 	.removeClass('bg-danger');
 
     $(".satmode_" + id).find("#cancelButton").replaceWith(
-        '<td style="text-align: center; vertical-align: middle;" id="deleteButton">' + '<button type="button" class="btn btn-sm btn-danger" onclick="deleteSatmode(' + id + ');' + '"><i class="fas fa-trash-alt"></i></button>' + '</td>'
+        '<td style="text-align: center; vertical-align: middle;" id="deleteButton">' + '<button type="button" class="btn btn-sm btn-danger deleteSatmode" infotext id="' + id + '"><i class="fas fa-trash-alt"></i></button>' + '</td>'
     );
 
 	$(".satmode_" + id).find("#saveButton").replaceWith(
-        '<td style="text-align: center; vertical-align: middle;" id="editButton">' + '<button type="button" class="btn btn-sm btn-success" onclick="editSatmode(' + id + ');' + '"><i class="fas fa-edit"></i></button>' + '</td>'
+        '<td style="text-align: center; vertical-align: middle;" id="editButton">' + '<button type="button" class="btn btn-sm btn-success editSatmode" id="' + id + '"><i class="fas fa-edit"></i></button>' + '</td>'
     );
 }
 
-function deleteSatmode(id) {
+function deleteSatmode(id, satmode) {
 	BootstrapDialog.confirm({
 		title: lang_general_word_danger,
-		message: 'Do you really want to delete this mode?',
+		message: 'Do you really want to delete the mode ' + satmode +'?',
 		type: BootstrapDialog.TYPE_DANGER,
 		closable: true,
 		draggable: true,
@@ -293,7 +304,7 @@ function addSatMode() {
 				.attr('contenteditable', 'false')
 				.removeClass('bg-danger');
 				tbl_row.find("#cancelButton").replaceWith(
-					'<td style="text-align: center; vertical-align: middle;" id="deleteButton">' + '<button type="button" class="btn btn-sm btn-danger" onclick="deleteSatmode('+data.inserted_id+');' + '"><i class="fas fa-trash-alt"></i></button></td>'
+					'<td style="text-align: center; vertical-align: middle;" id="deleteButton">' + '<button type="button" class="btn btn-sm btn-danger deleteSatmode" id="'+data.inserted_id+'" infotext="'+sanit(modename.html())+'"><i class="fas fa-trash-alt"></i></button></td>'
 				);
 
 				tbl_row.find("#saveButton").replaceWith(

From 47fc0cee852313394414e240e1f93f1df85663eb Mon Sep 17 00:00:00 2001
From: int2001 <joerg@dj7nt.de>
Date: Sun, 10 Mar 2024 13:07:17 +0000
Subject: [PATCH 2/2] Even more sanitizing

---
 application/views/satellite/edit.php  | 4 ++--
 application/views/satellite/index.php | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/application/views/satellite/edit.php b/application/views/satellite/edit.php
index 7fa783a9f..4f22ef7a8 100644
--- a/application/views/satellite/edit.php
+++ b/application/views/satellite/edit.php
@@ -43,13 +43,13 @@
 		<tbody>
 			<?php foreach ($satmodes as $mode) { ?>
 			<tr class="satmode_<?php echo $mode->id ?>">
-				<td id="modename_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;" ><?php echo $mode->name ?></td>
+				<td id="modename_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;" ><?php echo htmlentities($mode->name) ?></td>
 				<td id="uplink_mode_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->uplink_mode ?></td>
 				<td id="uplink_freq_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->uplink_freq ?></td>
 				<td id="downlink_mode_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->downlink_mode ?></td>
 				<td id="downlink_freq_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->downlink_freq ?></td>
 				<td id="editButton" style="text-align: center; vertical-align: middle;"><button id="<?php echo $mode->id ?>" class="btn btn-sm btn-success editSatmode"><i class="fas fa-edit"></i></button></td>
-				<td id="deleteButton" style="text-align: center; vertical-align: middle;"><button onclick="deleteSatmode('<?php echo $mode->id . '\',\'' . $mode->name ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
+				<td id="deleteButton" style="text-align: center; vertical-align: middle;"><button id="<?php echo $mode->id.'" infotext="'.htmlentities($mode->name) ?>" class="deleteSatmode btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
 			</tr>
 
 			<?php } ?>
diff --git a/application/views/satellite/index.php b/application/views/satellite/index.php
index 415ad9c3f..23c2484b2 100644
--- a/application/views/satellite/index.php
+++ b/application/views/satellite/index.php
@@ -29,8 +29,8 @@
 			<tbody>
 				<?php foreach ($satellites as $sat) { ?>
 				<tr>
-					<td style="text-align: center; vertical-align: middle;" class="satellite_<?php echo $sat->id ?>"><?php echo $sat->satname ?></td>
-					<td style="text-align: center; vertical-align: middle;"><?php echo $sat->exportname ?></td>
+					<td style="text-align: center; vertical-align: middle;" class="satellite_<?php echo $sat->id ?>"><?php echo htmlentities($sat->satname) ?></td>
+					<td style="text-align: center; vertical-align: middle;"><?php echo htmlentities($sat->exportname) ?></td>
 					<?php echo '<td style="text-align: center; vertical-align: middle;"><span class="badge ';
 					switch (strtoupper($sat->orbit)) {
 					case 'LEO':
@@ -48,9 +48,9 @@
 					}
 						echo '">'.$sat->orbit.'</span></td>';
 					?>
-					<td style="text-align: center; vertical-align: middle;"><?php echo $sat->modename ?></td>
+					<td style="text-align: center; vertical-align: middle;"><?php echo htmlentities($sat->modename ?? '') ?></td>
 					<td style="text-align: center; vertical-align: middle;"><button onclick="editSatelliteDialog(<?php echo $sat->id ?>)" class="btn btn-sm btn-success"><i class="fas fa-edit"></i></i></button></td>
-					<td style="text-align: center; vertical-align: middle;"><button onclick="deleteSatellite('<?php echo $sat->id . '\',\'' . $sat->satname ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
+					<td style="text-align: center; vertical-align: middle;"><button onclick="deleteSatellite('<?php echo $sat->id . '\',\'' . xss_clean(htmlentities(str_replace('\'',"\\'",str_replace('"','\"',str_replace('\\',' ',$sat->satname))))) ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
 				</tr>
 
 				<?php } ?>