-
Notifications
You must be signed in to change notification settings - Fork 7
Add Telegram as a configurable social link #258
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -21,6 +21,7 @@ | |||||||||||||||||
| $socialInstagram = (string) ConfigStore::get('app.social_instagram', ''); | ||||||||||||||||||
| $socialLinkedin = (string) ConfigStore::get('app.social_linkedin', ''); | ||||||||||||||||||
| $socialBluesky = (string) ConfigStore::get('app.social_bluesky', ''); | ||||||||||||||||||
| $socialTelegram = (string) ConfigStore::get('app.social_telegram', ''); | ||||||||||||||||||
| $catalogRoute = route_path('catalog'); | ||||||||||||||||||
| $reservationsRoute = route_path('reservations'); | ||||||||||||||||||
| $wishlistRoute = route_path('wishlist'); | ||||||||||||||||||
|
|
@@ -1674,6 +1675,10 @@ class="fab fa-linkedin"></i></a> | |||||||||||||||||
| <a href="<?= HtmlHelper::e($socialBluesky) ?>" target="_blank" rel="noopener noreferrer"><i | ||||||||||||||||||
| class="fa-brands fa-bluesky"></i></a> | ||||||||||||||||||
| <?php endif; ?> | ||||||||||||||||||
| <?php if ($socialTelegram !== ''): ?> | ||||||||||||||||||
| <a href="<?= HtmlHelper::e($socialTelegram) ?>" target="_blank" rel="noopener noreferrer"><i | ||||||||||||||||||
| class="fa-brands fa-telegram"></i></a> | ||||||||||||||||||
| <?php endif; ?> | ||||||||||||||||||
|
Comment on lines
+1678
to
+1681
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win Violazione delle direttive di progetto: non usare Entrambi i file utilizzano
🛡️ Modifica suggerita- <a href="<?= HtmlHelper::e($socialTelegram) ?>" target="_blank" rel="noopener noreferrer"><i
+ <a href="<?= htmlspecialchars($socialTelegram, ENT_QUOTES, 'UTF-8') ?>" target="_blank" rel="noopener noreferrer"><i
class="fa-brands fa-telegram"></i></a>📝 Committable suggestion
Suggested change
📍 Affects 2 files
🤖 Prompt for AI AgentsSource: Path instructions
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. My change is stereotyped, the issue targets the existing code. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
La richiesta resta quindi limitata ai nuovi link Telegram; non richiede di modificare i link social preesistenti. |
||||||||||||||||||
| </div> | ||||||||||||||||||
| </div> | ||||||||||||||||||
| </div> | ||||||||||||||||||
|
|
||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| -- Migration 0.7.35 — add Telegram social link setting. | ||
| -- | ||
| -- Existing installations upgraded to 0.7.35 must get app.social_telegram | ||
| -- in system_settings so the new admin/footer integration can persist/read it. | ||
| -- INSERT IGNORE keeps this idempotent on reruns and on fresh installs seeded | ||
| -- from installer/database/data_*.sql. | ||
|
|
||
| INSERT IGNORE INTO `system_settings` (`category`, `setting_key`, `setting_value`, `description`) VALUES | ||
| ('app', 'social_telegram', '', 'Telegram profile URL'); |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| <?php | ||
| declare(strict_types=1); | ||
|
|
||
| /** | ||
| * Static coverage for issue #257 (Telegram social link). | ||
| * | ||
| * Run: | ||
| * php tests/issue-257-telegram-social-links.unit.php | ||
| */ | ||
|
|
||
| $root = dirname(__DIR__); | ||
| $failed = 0; | ||
| $passed = 0; | ||
|
|
||
| $check = static function (bool $cond, string $label) use (&$failed, &$passed): void { | ||
| if ($cond) { | ||
| $passed++; | ||
| echo " OK {$label}\n"; | ||
| return; | ||
| } | ||
| $failed++; | ||
| echo " FAIL {$label}\n"; | ||
| }; | ||
|
|
||
| $read = static function (string $rel) use ($root): string { | ||
| $path = $root . '/' . $rel; | ||
| if (!is_file($path)) { | ||
| throw new RuntimeException("Missing file: {$rel}"); | ||
| } | ||
| $content = file_get_contents($path); | ||
| if ($content === false) { | ||
| throw new RuntimeException("Unreadable file: {$rel}"); | ||
| } | ||
| return $content; | ||
| }; | ||
|
|
||
| try { | ||
| $configStore = $read('app/Support/ConfigStore.php'); | ||
| $settingsController = $read('app/Controllers/SettingsController.php'); | ||
| $settingsView = $read('app/Views/settings/index.php'); | ||
| $frontendLayout = $read('app/Views/frontend/layout.php'); | ||
| $userLayout = $read('app/Views/user_layout.php'); | ||
| $migration = $read('installer/database/migrations/migrate_0.7.35.sql'); | ||
| $seedEn = $read('installer/database/data_en_US.sql'); | ||
| $seedDe = $read('installer/database/data_de_DE.sql'); | ||
| $seedFr = $read('installer/database/data_fr_FR.sql'); | ||
| $seedIt = $read('installer/database/data_it_IT.sql'); | ||
|
|
||
| $check(str_contains($configStore, "'social_telegram' => ''"), 'ConfigStore default includes social_telegram'); | ||
| $check(str_contains($settingsController, "'social_telegram' => trim((string) (\$data['social_telegram'] ?? ''))"), 'SettingsController saves social_telegram'); | ||
| $check(str_contains($settingsController, "'social_telegram' => \$repository->get('app', 'social_telegram', \$config['social_telegram'] ?? '')"), 'SettingsController resolves social_telegram'); | ||
| $check(str_contains($settingsView, 'id="social_telegram"'), 'Settings view has social_telegram input'); | ||
| $check(str_contains($settingsView, 'class="fa-brands fa-telegram mr-1"'), 'Settings view uses Telegram icon'); | ||
| $check(str_contains($frontendLayout, "ConfigStore::get('app.social_telegram', '')"), 'Frontend layout loads social_telegram'); | ||
| $check(str_contains($frontendLayout, 'class="fa-brands fa-telegram"'), 'Frontend layout renders Telegram icon'); | ||
| $check(str_contains($userLayout, "ConfigStore::get('app.social_telegram', '')"), 'User layout loads social_telegram'); | ||
| $check(str_contains($userLayout, 'class="fa-brands fa-telegram"'), 'User layout renders Telegram icon'); | ||
| $check(str_contains($migration, "'app', 'social_telegram', '', 'Telegram profile URL'"), 'Migration inserts social_telegram'); | ||
| $check(str_contains($seedEn, "('app', 'social_telegram', '', 'Telegram profile URL', NOW())"), 'en_US seed includes social_telegram'); | ||
| $check(str_contains($seedDe, "('app', 'social_telegram', '', 'Telegram-Profil-URL', NOW())"), 'de_DE seed includes social_telegram'); | ||
| $check(str_contains($seedFr, "('app', 'social_telegram', '', 'URL du profil Telegram', NOW())"), 'fr_FR seed includes social_telegram'); | ||
| $check(str_contains($seedIt, "('app', 'social_telegram', '', 'Telegram profile URL', NOW())"), 'it_IT seed includes social_telegram'); | ||
| } catch (Throwable $e) { | ||
| $failed++; | ||
| echo " FAIL exception: " . $e->getMessage() . "\n"; | ||
| } | ||
|
|
||
| echo "\n {$passed} passed, {$failed} failed\n"; | ||
| exit($failed === 0 ? 0 : 1); |
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Validare e sanitizzare l’URL Telegram lato server.
type="url"è solo una validazione client-side: un POST arbitrario può salvarejavascript:o altri schemi pericolosi, che diventano eseguibili quando il valore viene usato nel footer. RiusaHtmlHelper::sanitizePublicHttpUrl()e rifiuta valori non vuoti non validi prima di persisterli.🤖 Prompt for AI Agents
Source: Path instructions
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My change is stereotyped, the issue targets the existing code.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Himura2la, corretto che il pattern esisteva già. Tuttaviasocial_telegramaggiunge un nuovo input persistito e renderizzato nel footer, quindi eredita direttamente la stessa vulnerabilità.Per una correzione coerente, validerei tutti i link social nel loop con
HtmlHelper::sanitizePublicHttpUrl()e rifiuterei qualsiasi valore non vuoto che non sia HTTP(S), invece di limitarsi a Telegram.