From 9449a87a1f6747d017dedc085d94634755037b71 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Mon, 22 May 2023 10:39:50 -0400
Subject: [PATCH] Strip Out http and https in domains, vendors and passwords

---
 models/client_logins.php | 2 +-
 models/vendor.php        | 2 +-
 post.php                 | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/models/client_logins.php b/models/client_logins.php
index a703ccd9..355f7f9d 100644
--- a/models/client_logins.php
+++ b/models/client_logins.php
@@ -1,7 +1,7 @@
 <?php
 $client_id = intval($_POST['client_id']);
 $name = sanitizeInput($_POST['name']);
-$uri = sanitizeInput($_POST['uri']);
+$uri = preg_replace("(^https?://)", "", sanitizeInput($_POST['uri']));
 $username = encryptLoginEntry($_POST['username']);
 $password = encryptLoginEntry($_POST['password']);
 $otp_secret = sanitizeInput($_POST['otp_secret']);
diff --git a/models/vendor.php b/models/vendor.php
index 156ac53e..a62795e7 100644
--- a/models/vendor.php
+++ b/models/vendor.php
@@ -6,7 +6,7 @@ $contact_name = sanitizeInput($_POST['contact_name']);
 $phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
 $extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
 $email = sanitizeInput($_POST['email']);
-$website = sanitizeInput($_POST['website']);
+$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website']));
 $hours = sanitizeInput($_POST['hours']);
 $sla = sanitizeInput($_POST['sla']);
 $code = sanitizeInput($_POST['code']);
diff --git a/post.php b/post.php
index 8a25ca7d..ea78a15d 100644
--- a/post.php
+++ b/post.php
@@ -6181,7 +6181,7 @@ if(isset($_POST['add_domain'])){
     validateTechRole();
 
     $client_id = intval($_POST['client_id']);
-    $name = sanitizeInput($_POST['name']);
+    $name = preg_replace("(^https?://)", "", sanitizeInput($_POST['name']));
     $registrar = intval($_POST['registrar']);
     $webhost = intval($_POST['webhost']);
     $extended_log_description = '';
@@ -6238,7 +6238,7 @@ if(isset($_POST['edit_domain'])){
     validateTechRole();
 
     $domain_id = intval($_POST['domain_id']);
-    $name = sanitizeInput($_POST['name']);
+    $name = preg_replace("(^https?://)", "", sanitizeInput($_POST['name']));
     $registrar = intval($_POST['registrar']);
     $webhost = intval($_POST['webhost']);
     $expire = sanitizeInput($_POST['expire']);