ClicShopping #353

        // Extract statement type
        $stmt_type = strtoupper(trim(explode(' ', $sql)[0]));
        // Whitelist allowed SQL types
        if (!in_array($stmt_type, $allowed_statements)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc
                Open Issue
             Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
          $CLICSHOPPING_MessageStack->add('Restore skipped: unsupported SQL statement type (' . $stmt_type . ')', 'warning');
          continue;
        }
        // Validate DROP TABLE statements to prevent SQL injection

    }
    // Optional: Whitelist specific domains (e.g., GitHub)
    // Uncomment and modify as needed:
      $allowed_domains = ['github.com', 'api.github.com'];
      if (!in_array($parsed_url['host'] ?? '', $allowed_domains)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc
                Open Issue
             Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
        $this->messageStack->add('Download from unauthorized domain', 'error');
        CLICSHOPPING::redirect('Upgrade&Marketplace');
        return null;
       }

      $flags['session_id'] = false;
    }
    // Security: Validate method against whitelist
    $allowed_methods = ['post', 'get'];
    $safe_method = in_array(strtolower($method ?? 'post'), $allowed_methods) ? strtolower($method ?? 'post') : 'post';
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc
                Open Issue
             Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
    // Security: Sanitize form action URL
    $safe_action = static::sanitizeUrl($action);
    $form = '<form name="' . static::outputProtected($name) . '" action="' . $safe_action . '" method="' . $safe_method . '"';