From 2210ad9f3e5317fcced111432b70e85c185b619f Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sun, 5 Mar 2023 19:25:24 +0000
Subject: [PATCH] Add stronger input validation/output escaping for theme, tags
 and categories vars

---
 models/category.php | 2 +-
 models/tag.php      | 4 ++--
 post.php            | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/models/category.php b/models/category.php
index 2b8b1517..c72cc68a 100644
--- a/models/category.php
+++ b/models/category.php
@@ -1,4 +1,4 @@
 <?php
 $name = sanitizeInput($_POST['name']);
 $type = sanitizeInput($_POST['type']);
-$color = preg_replace("/[^0-9a-zA-Z_]/", "", sanitizeInput($_POST['color']));
+$color = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['color']));
diff --git a/models/tag.php b/models/tag.php
index e9b4c176..772bc245 100644
--- a/models/tag.php
+++ b/models/tag.php
@@ -1,5 +1,5 @@
 <?php
 $name = sanitizeInput($_POST['name']);
 $type = intval($_POST['type']);
-$color = preg_replace("/[^0-9a-zA-Z_]/", "", sanitizeInput($_POST['color']));
-$icon = preg_replace("/[^0-9a-zA-Z_]/", "", sanitizeInput($_POST['icon']));
+$color = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['color']));
+$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon']));
diff --git a/post.php b/post.php
index f87d458e..6269ee6d 100644
--- a/post.php
+++ b/post.php
@@ -870,7 +870,7 @@ if(isset($_POST['edit_theme_settings'])){
 
     validateAdminRole();
 
-    $theme = preg_replace("/[^0-9a-zA-Z_]/", "", sanitizeInput($_POST['theme']));
+    $theme = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['theme']));
 
     mysqli_query($mysqli,"UPDATE settings SET config_theme = '$theme' WHERE company_id = $session_company_id");