From 47fc0cee852313394414e240e1f93f1df85663eb Mon Sep 17 00:00:00 2001
From: int2001 <joerg@dj7nt.de>
Date: Sun, 10 Mar 2024 13:07:17 +0000
Subject: [PATCH] Even more sanitizing

---
 application/views/satellite/edit.php  | 4 ++--
 application/views/satellite/index.php | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/application/views/satellite/edit.php b/application/views/satellite/edit.php
index 7fa783a9f..4f22ef7a8 100644
--- a/application/views/satellite/edit.php
+++ b/application/views/satellite/edit.php
@@ -43,13 +43,13 @@
 		<tbody>
 			<?php foreach ($satmodes as $mode) { ?>
 			<tr class="satmode_<?php echo $mode->id ?>">
-				<td id="modename_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;" ><?php echo $mode->name ?></td>
+				<td id="modename_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;" ><?php echo htmlentities($mode->name) ?></td>
 				<td id="uplink_mode_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->uplink_mode ?></td>
 				<td id="uplink_freq_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->uplink_freq ?></td>
 				<td id="downlink_mode_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->downlink_mode ?></td>
 				<td id="downlink_freq_<?php echo $mode->id ?>" class="row_data" style="text-align: center; vertical-align: middle;"><?php echo $mode->downlink_freq ?></td>
 				<td id="editButton" style="text-align: center; vertical-align: middle;"><button id="<?php echo $mode->id ?>" class="btn btn-sm btn-success editSatmode"><i class="fas fa-edit"></i></button></td>
-				<td id="deleteButton" style="text-align: center; vertical-align: middle;"><button onclick="deleteSatmode('<?php echo $mode->id . '\',\'' . $mode->name ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
+				<td id="deleteButton" style="text-align: center; vertical-align: middle;"><button id="<?php echo $mode->id.'" infotext="'.htmlentities($mode->name) ?>" class="deleteSatmode btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
 			</tr>
 
 			<?php } ?>
diff --git a/application/views/satellite/index.php b/application/views/satellite/index.php
index 415ad9c3f..23c2484b2 100644
--- a/application/views/satellite/index.php
+++ b/application/views/satellite/index.php
@@ -29,8 +29,8 @@
 			<tbody>
 				<?php foreach ($satellites as $sat) { ?>
 				<tr>
-					<td style="text-align: center; vertical-align: middle;" class="satellite_<?php echo $sat->id ?>"><?php echo $sat->satname ?></td>
-					<td style="text-align: center; vertical-align: middle;"><?php echo $sat->exportname ?></td>
+					<td style="text-align: center; vertical-align: middle;" class="satellite_<?php echo $sat->id ?>"><?php echo htmlentities($sat->satname) ?></td>
+					<td style="text-align: center; vertical-align: middle;"><?php echo htmlentities($sat->exportname) ?></td>
 					<?php echo '<td style="text-align: center; vertical-align: middle;"><span class="badge ';
 					switch (strtoupper($sat->orbit)) {
 					case 'LEO':
@@ -48,9 +48,9 @@
 					}
 						echo '">'.$sat->orbit.'</span></td>';
 					?>
-					<td style="text-align: center; vertical-align: middle;"><?php echo $sat->modename ?></td>
+					<td style="text-align: center; vertical-align: middle;"><?php echo htmlentities($sat->modename ?? '') ?></td>
 					<td style="text-align: center; vertical-align: middle;"><button onclick="editSatelliteDialog(<?php echo $sat->id ?>)" class="btn btn-sm btn-success"><i class="fas fa-edit"></i></i></button></td>
-					<td style="text-align: center; vertical-align: middle;"><button onclick="deleteSatellite('<?php echo $sat->id . '\',\'' . $sat->satname ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
+					<td style="text-align: center; vertical-align: middle;"><button onclick="deleteSatellite('<?php echo $sat->id . '\',\'' . xss_clean(htmlentities(str_replace('\'',"\\'",str_replace('"','\"',str_replace('\\',' ',$sat->satname))))) ?>')" class="btn btn-sm btn-danger"><i class="fas fa-trash-alt"></i></button></td>
 				</tr>
 
 				<?php } ?>