Replace FILTER_SANITIZE_SPECIAL_CHARS with h() function (CFM-318)

app/plugins/CoreServer/src/Controller/Oauth2ServersController.php

@@ -176,7 +176,7 @@ function performRedirect(): void
       $target['plugin'] = 'CoreServer';
       $target['controller'] = 'Oauth2Servers';
       $target['action'] = 'edit';
-      $target[] = filter_var($this->getRequest()->getParam('pass')[0], FILTER_SANITIZE_SPECIAL_CHARS);
+      $target[] = h($this->getRequest()->getParam('pass')[0]);
     } else {
       $target['controller'] = 'Servers';
       $target['action'] = 'index';

app/src/Controller/DashboardsController.php

@@ -342,7 +342,7 @@ public function search() {
 
       $this->Flash->information(__d('result',
                                     'search.exact',
-                                    [filter_var($this->request->getData('q'), FILTER_SANITIZE_SPECIAL_CHARS),
+                                    [h($this->request->getData('q')),
                                       __d('controller', $matchClass, [1])]));
 
       // Redirect to the matchClass controller
@@ -358,7 +358,7 @@ public function search() {
 
       $this->Flash->information(__d('result',
                                     'search.exact',
-                                    [filter_var($this->request->getData('q'), FILTER_SANITIZE_SPECIAL_CHARS),
+                                    [h($this->request->getData('q')),
                                      'uuid']));
 
       return $this->redirect([

app/templates/Cos/select.php

@@ -62,7 +62,7 @@
       </div>
       <div class="col collab-desc">
   <!-- XXX need to add "Not a Member" tag, maybe as a separate column instead of part of the link -->
-        <?= filter_var($co->description, FILTER_SANITIZE_SPECIAL_CHARS); ?>
+        <?= h($co->description); ?>
       </div>
     </div>
     <?php endforeach; // vv_available_cos ?>

app/templates/Dashboards/search.php

@@ -144,7 +144,7 @@ class="tab-pane fade<?= $isFirstTab ? ' show active' : '' ?>"
                       <?= $displayString ?>
                     </div>
                     <div class="search-result-match-info">
-                      <?= filter_var($matchInfo, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+                      <?= h($matchInfo) ?>
                     </div>
                   </a>
                 </li>
@@ -181,7 +181,7 @@ class="tab-pane fade<?= $isFirstTab ? ' show active' : '' ?>"
                     <?= $displayString ?>
                   </div>
                   <div class="search-result-match-info">
-                    <?= filter_var($matchInfo, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+                    <?= h($matchInfo) ?>
                   </div>
                 </a>
               </li>

app/templates/ExternalIdentitySources/retrieve.php

@@ -340,7 +340,7 @@
     <div id="source-record-raw">
       <?php if(!empty($vv_eis_record['source_record'])): ?>
         <code class="source-record">
-          <?= filter_var($vv_eis_record['source_record'], FILTER_SANITIZE_SPECIAL_CHARS) ?>
+          <?= h($vv_eis_record['source_record']) ?>
         </code>
       <?php else: ?>
         <div class="alert alert-info co-alert" role="alert">

app/templates/ProvisioningTargets/status.php

@@ -99,12 +99,12 @@
           ?>
           </div>
         </td>
-        <td><?= filter_var($p['target']->description, FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['target']->description) ?></td>
         <td><?= __d('enumeration', 'ProvisioningStatusEnum.'.$p['status']); ?></td>
-        <td><?= filter_var($p['comment'], FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['comment']) ?></td>
         <td><?= __d('enumeration', 'ProvisioningStatusEnum.'.$p['laststatus']); ?></td>
-        <td><?= filter_var($p['lastcomment'], FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
-        <td><?= filter_var($p['identifier'] ?? "", FILTER_SANITIZE_SPECIAL_CHARS); ?></td>
+        <td><?= h($p['lastcomment']) ?></td>
+        <td><?= h($p['identifier'] ?? "") ?></td>
         <td><?= !empty($p['timestamp']) ? $this->Time->nice($p['timestamp'], $vv_tz) : ""; ?></td>
       </tr>
       <?php endforeach; ?>

app/templates/element/filter/filter.php

@@ -69,8 +69,8 @@
 // Hidden Form fields
 foreach($this->Filter->getHiddenFields() as $param => $value) {
   print $this->Form->hidden(
-      filter_var($param, FILTER_SANITIZE_SPECIAL_CHARS),
-      array('default' => filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS))) . PHP_EOL;
+      h($param),
+      array('default' => h($value))) . PHP_EOL;
 }
 
 ?>

app/templates/element/filter/topButtons.php

@@ -79,7 +79,7 @@
   <span class="top-filters-active-filter-title"><?= $filter_title ?></span>
   <?php if($vv_searchable_attributes[$key]['type'] != 'boolean'): ?>
   <span class="top-filters-active-filter-value">
-    <?= filter_var($button_label, FILTER_SANITIZE_SPECIAL_CHARS) ?>
+    <?= h($button_label) ?>
   </span>
   <?php endif; ?>
 </button>

app/templates/element/links.php

@@ -37,13 +37,13 @@
 
       if(isset($vv_NavLinks)) {
         foreach($vv_NavLinks as $l){
-          print '<li><a href="' . $l['NavigationLink']['url'] . '">' . filter_var($l['NavigationLink']['title'],FILTER_SANITIZE_SPECIAL_CHARS) . '</a>';
+          print '<li><a href="' . $l['NavigationLink']['url'] . '">' . h($l['NavigationLink']['title']) . '</a>';
         }
       }
 
       if(isset($vv_CoNavLinks)) {
         foreach($vv_CoNavLinks as $l){
-          print '<li><a href="' . $l['CoNavigationLink']['url'] . '">' . filter_var($l['CoNavigationLink']['title'],FILTER_SANITIZE_SPECIAL_CHARS) . '</a>';
+          print '<li><a href="' . $l['CoNavigationLink']['url'] . '">' . h($l['CoNavigationLink']['title']) . '</a>';
         }
       }
       ?>