From bbd20ecbb5bc415caac490f46032065a92a50d1e Mon Sep 17 00:00:00 2001
From: Arlen Johnson <arlen@sphericalcowgroup.com>
Date: Wed, 24 Jun 2026 12:26:09 -0400
Subject: [PATCH] Replace FILTER_SANITIZE_SPECIAL_CHARS with h() function
 (CFM-318)

---
 .../CoreServer/src/Controller/Oauth2ServersController.php | 2 +-
 app/src/Controller/DashboardsController.php               | 4 ++--
 app/templates/Cos/select.php                              | 2 +-
 app/templates/Dashboards/search.php                       | 4 ++--
 app/templates/ExternalIdentitySources/retrieve.php        | 2 +-
 app/templates/ProvisioningTargets/status.php              | 8 ++++----
 app/templates/element/filter/filter.php                   | 4 ++--
 app/templates/element/filter/topButtons.php               | 2 +-
 app/templates/element/links.php                           | 4 ++--
 9 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/app/plugins/CoreServer/src/Controller/Oauth2ServersController.php b/app/plugins/CoreServer/src/Controller/Oauth2ServersController.php
index 40c2cbfcb..c5933f211 100644
--- a/app/plugins/CoreServer/src/Controller/Oauth2ServersController.php
+++ b/app/plugins/CoreServer/src/Controller/Oauth2ServersController.php
@@ -176,7 +176,7 @@ function performRedirect(): void
       $target['plugin'] = 'CoreServer';
       $target['controller'] = 'Oauth2Servers';
       $target['action'] = 'edit';
-      $target[] = filter_var($this->getRequest()->getParam('pass')[0], FILTER_SANITIZE_SPECIAL_CHARS);
+      $target[] = h($this->getRequest()->getParam('pass')[0]);
     } else {
       $target['controller'] = 'Servers';
       $target['action'] = 'index';
diff --git a/app/src/Controller/DashboardsController.php b/app/src/Controller/DashboardsController.php
index 0a522b96d..69c4e0240 100644
--- a/app/src/Controller/DashboardsController.php
+++ b/app/src/Controller/DashboardsController.php
@@ -342,7 +342,7 @@ public function search() {
 
       $this->Flash->information(__d('result',
                                     'search.exact',
-                                    [filter_var($this->request->getData('q'), FILTER_SANITIZE_SPECIAL_CHARS),
+                                    [h($this->request->getData('q')),
                                       __d('controller', $matchClass, [1])]));
 
       // Redirect to the matchClass controller
@@ -358,7 +358,7 @@ public function search() {
 
       $this->Flash->information(__d('result',
                                     'search.exact',
-                                    [filter_var($this->request->getData('q'), FILTER_SANITIZE_SPECIAL_CHARS),
+                                    [h($this->request->getData('q')),
                                      'uuid']));
 
       return $this->redirect([
diff --git a/app/templates/Cos/select.php b/app/templates/Cos/select.php
index 5f1b11e18..783d1e537 100644
--- a/app/templates/Cos/select.php
+++ b/app/templates/Cos/select.php
@@ -62,7 +62,7 @@
       </div>
       <div class="col collab-desc">
   <!-- XXX need to add "Not a Member" tag, maybe as a separate column instead of part of the link -->
-        <?= filter_var($co->description, FILTER_SANITIZE_SPECIAL_CHARS); ?>
+        <?= h($co->description); ?>
       </div>
     </div>
     <?php endforeach; // vv_available_cos ?>
diff --git a/app/templates/Dashboards/search.php b/app/templates/Dashboards/search.php
index ab4357d64..c5ff15f57 100644
--- a/app/templates/Dashboards/search.php
+++ b/app/templates/Dashboards/search.php
@@ -144,7 +144,7 @@ class="tab-pane fade<?= $isFirstTab ? ' show active' : '' ?>"
                       <?= $displayString ?>
                     </div>
                     <div class="search-result-match-info">
-                      <?= filter_var($matchInfo, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+                      <?= h($matchInfo) ?>
                     </div>
                   </a>
                 </li>
@@ -181,7 +181,7 @@ class="tab-pane fade<?= $isFirstTab ? ' show active' : '' ?>"
                     <?= $displayString ?>
                   </div>
                   <div class="search-result-match-info">
-                    <?= filter_var($matchInfo, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+                    <?= h($matchInfo) ?>
                   </div>
                 </a>
               </li>
diff --git a/app/templates/ExternalIdentitySources/retrieve.php b/app/templates/ExternalIdentitySources/retrieve.php
index 19270cda0..bfcbbf6a7 100644
--- a/app/templates/ExternalIdentitySources/retrieve.php
+++ b/app/templates/ExternalIdentitySources/retrieve.php
@@ -340,7 +340,7 @@
     <div id="source-record-raw">
       <?php if(!empty($vv_eis_record['source_record'])): ?>
         <code class="source-record">
-          <?= filter_var($vv_eis_record['source_record'], FILTER_SANITIZE_SPECIAL_CHARS) ?>
+          <?= h($vv_eis_record['source_record']) ?>
         </code>
       <?php else: ?>
         <div class="alert alert-info co-alert" role="alert">
diff --git a/app/templates/ProvisioningTargets/status.php b/app/templates/ProvisioningTargets/status.php
index 8eb3c5b69..bfeddf769 100644
--- a/app/templates/ProvisioningTargets/status.php
+++ b/app/templates/ProvisioningTargets/status.php
@@ -99,12 +99,12 @@
           ?>
           </div>
         </td>
-        <td><?= filter_var($p['target']->description, FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['target']->description) ?></td>
         <td><?= __d('enumeration', 'ProvisioningStatusEnum.'.$p['status']); ?></td>
-        <td><?= filter_var($p['comment'], FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['comment']) ?></td>
         <td><?= __d('enumeration', 'ProvisioningStatusEnum.'.$p['laststatus']); ?></td>
-        <td><?= filter_var($p['lastcomment'], FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
-        <td><?= filter_var($p['identifier'] ?? "", FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['lastcomment']) ?></td>
+        <td><?= h($p['identifier'] ?? "") ?></td>
         <td><?= !empty($p['timestamp']) ? $this->Time->nice($p['timestamp'], $vv_tz) : ""; ?></td>
       </tr>
       <?php endforeach; ?>
diff --git a/app/templates/element/filter/filter.php b/app/templates/element/filter/filter.php
index 0b65285e5..cc894b60a 100644
--- a/app/templates/element/filter/filter.php
+++ b/app/templates/element/filter/filter.php
@@ -69,8 +69,8 @@
 // Hidden Form fields
 foreach($this->Filter->getHiddenFields() as $param => $value) {
   print $this->Form->hidden(
-      filter_var($param, FILTER_SANITIZE_SPECIAL_CHARS),
-      array('default' => filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS))) . PHP_EOL;
+      h($param),
+      array('default' => h($value))) . PHP_EOL;
 }
 
 ?>
diff --git a/app/templates/element/filter/topButtons.php b/app/templates/element/filter/topButtons.php
index d89e9199f..248f20bf2 100644
--- a/app/templates/element/filter/topButtons.php
+++ b/app/templates/element/filter/topButtons.php
@@ -79,7 +79,7 @@
   <span class="top-filters-active-filter-title"><?= $filter_title ?></span>
   <?php if($vv_searchable_attributes[$key]['type'] != 'boolean'): ?>
   <span class="top-filters-active-filter-value">
-    <?= filter_var($button_label, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+    <?= h($button_label) ?>
   </span>
   <?php endif; ?>
 </button>
\ No newline at end of file
diff --git a/app/templates/element/links.php b/app/templates/element/links.php
index 492674593..c5a85d0aa 100644
--- a/app/templates/element/links.php
+++ b/app/templates/element/links.php
@@ -37,13 +37,13 @@
       
       if(isset($vv_NavLinks)) {
         foreach($vv_NavLinks as $l){
-          print '<li><a href="' . $l['NavigationLink']['url'] . '">' . filter_var($l['NavigationLink']['title'],FILTER_SANITIZE_SPECIAL_CHARS) . '</a>';
+          print '<li><a href="' . $l['NavigationLink']['url'] . '">' . h($l['NavigationLink']['title']) . '</a>';
         }
       }
       
       if(isset($vv_CoNavLinks)) {
         foreach($vv_CoNavLinks as $l){
-          print '<li><a href="' . $l['CoNavigationLink']['url'] . '">' . filter_var($l['CoNavigationLink']['title'],FILTER_SANITIZE_SPECIAL_CHARS) . '</a>';
+          print '<li><a href="' . $l['CoNavigationLink']['url'] . '">' . h($l['CoNavigationLink']['title']) . '</a>';
         }
       }
       ?>