Merge branch 'fix-array-query-params' into 'master'

Allow arrays when sanitizing GET query parameters

See merge request davical-project/davical!143

.gitlab-ci.yml

@@ -11,7 +11,7 @@ build:
   script:
     - apt-get -y update
     - bash -c 'mkdir -p /usr/share/man/man{0..10}'
-    - apt-get -y install build-essential devscripts fakeroot dh-exec jdupes doxygen graphviz php-cli phpunit rst2pdf
+    - apt-get -y install build-essential curl devscripts fakeroot dh-exec jdupes doxygen graphviz php-cli phpunit rst2pdf
     - mv debian/changelog debian/changelog.old
     - >
       cat

debian/changelog

@@ -1,3 +1,24 @@
+davical (1.1.12-2.3) unstable; urgency=medium
+
+  * Non-maintainer upload
+  * No change upload for the reproducible effort
+
+ -- David Prévot <taffit@debian.org>  Wed, 26 Nov 2025 08:37:04 +0100
+
+davical (1.1.12-2.2) unstable; urgency=medium
+
+  * Non-maintainer upload
+  * Update latest patch to PHPUnit 12 syntax (Closes: #1099659)
+
+ -- David Prévot <taffit@debian.org>  Thu, 25 Sep 2025 08:27:38 +0200
+
+davical (1.1.12-2.1) unstable; urgency=medium
+
+  * Non-maintainer upload
+  * Add support for PHPUnit 10 (Closes: #1039746)
+
+ -- David Prévot <taffit@debian.org>  Tue, 14 Jan 2025 13:45:14 +0100
+
 davical (1.1.13-1) UNRELEASED; urgency=medium
 
   * New upstream release (Closes: #1040996)

htdocs/always.php

@@ -32,9 +32,21 @@ function clean_get() {
 
     foreach($_GET as $key => $value) {
         // XSS is possible in both key and values
-        $k = htmlspecialchars($key);
+        $key = htmlspecialchars($key);
-        $v = htmlspecialchars($value);
+
-        $temp[$k] = $v;
+        switch (gettype($value)) {
+            case "string":
+                $value = htmlspecialchars($value);
+                break;
+            case "array":
+                array_walk_recursive($value, function(&$v) {
+                    if (gettype($v) == "string") {
+                        $v = htmlspecialchars($v);
+                    }
+                });
+                break;
+        }
+        $temp[$key] = $value;
     }
 
     return $temp;

testing/phpunit/ExpansionTest.php

@@ -5,6 +5,8 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '/usr/share/awl/inc' . PA
 require_once('RRule.php');
 require_once('vCalendar.php');
 
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
 use PHPUnit\Framework\TestCase;
 
 $c = (object) array();
@@ -143,10 +145,8 @@ final class ExpansionTest extends TestCase
     '20190124T000000Z/20190124T010000Z',
   ];
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testUnmodifiedCal() {
     global $base_cal;
 
@@ -156,10 +156,8 @@ final class ExpansionTest extends TestCase
     );
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testTueRenamed() {
     global $tuesday_renamed_cal;
 
@@ -169,10 +167,8 @@ final class ExpansionTest extends TestCase
     );
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testTueRenamedSwapped() {
     global $tuesday_renamed_cal_order_swapped;
 
@@ -182,10 +178,8 @@ final class ExpansionTest extends TestCase
     );
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testCalWithCount() {
     global $count_cal;
 

testing/phpunit/RangeTest.php

@@ -5,6 +5,8 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '/usr/share/awl/inc' . PA
 require_once('RRule.php');
 require_once('vCalendar.php');
 
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
 use PHPUnit\Framework\TestCase;
 
 $c = (object) array();
@@ -12,10 +14,8 @@ $c->rrule_loop_limit = 100;
 
 final class RangeTest extends TestCase
 {
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testGetVCalendarRange() {
     $cal = new vCalendar("BEGIN:VCALENDAR
 PRODID:-//Mozilla.org/NONSGML Mozilla Calendar V1.1//EN
@@ -52,10 +52,8 @@ END:VCALENDAR");
     self::assertEquals("20190102T072000Z", (string) $range->until->UTC());
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testGetVCalendarRangeTwoDayAllDay() {
     $cal = new vCalendar("BEGIN:VCALENDAR
 PRODID:-//Mozilla.org/NONSGML Mozilla Calendar V1.1//EN
@@ -78,10 +76,8 @@ END:VCALENDAR");
     self::assertEquals("20190109T200000Z", (string) $range->until->UTC());
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testGetVCalendarRangeFloating() {
     // When interpreted as being in Greece, this event crosses the daylight savings boundary!
     // TODO deal with how that affects all-day events...
@@ -106,10 +102,8 @@ END:VCALENDAR");
     self::assertEquals("20181210T130000Z", (string) $range->until->UTC());
   }
 
-  /**
+  #[PreserveGlobalState('enabled')]
-   * @runInSeparateProcess
+  #[RunInSeparateProcess]
-   * @preserveGlobalState enabled
-   */
   public function testGetVCalendarRangeAllDayAcrossDST() {
     // When interpreted as being in Greece, this event crosses the daylight savings boundary!