From e5a2741d6f917851296aa7170d83d3bfd67160c4 Mon Sep 17 00:00:00 2001
From: fabiodalez-dev <fabiodalezbackup@gmail.com>
Date: Fri, 17 Jul 2026 16:48:22 +0200
Subject: [PATCH] fix(#260): escape social settings inputs with
 htmlspecialchars, not HtmlHelper::e
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeRabbit flagged the Telegram input for using HtmlHelper::e() in a view, which
the project rules forbid — but all six social inputs (facebook/twitter/
instagram/linkedin/bluesky/telegram) had the same pattern. Converted them all to
htmlspecialchars(..., ENT_QUOTES, 'UTF-8') for consistency, not just the one
CodeRabbit saw.
---
 app/Views/settings/index.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/Views/settings/index.php b/app/Views/settings/index.php
index bbd46d7f..36443c60 100644
--- a/app/Views/settings/index.php
+++ b/app/Views/settings/index.php
@@ -166,7 +166,7 @@ class="mt-1 block w-full rounded-xl border-gray-300 focus:border-gray-500 focus:
                     <input type="url"
                            id="social_facebook"
                            name="social_facebook"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_facebook'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_facebook'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://facebook.com/tuapagina') ?>">
                   </div>
@@ -177,7 +177,7 @@ class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-
                     <input type="url"
                            id="social_twitter"
                            name="social_twitter"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_twitter'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_twitter'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://twitter.com/tuoprofilo') ?>">
                   </div>
@@ -188,7 +188,7 @@ class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-
                     <input type="url"
                            id="social_instagram"
                            name="social_instagram"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_instagram'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_instagram'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://instagram.com/tuoprofilo') ?>">
                   </div>
@@ -199,7 +199,7 @@ class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-
                     <input type="url"
                            id="social_linkedin"
                            name="social_linkedin"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_linkedin'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_linkedin'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://linkedin.com/company/tuaazienda') ?>">
                   </div>
@@ -210,7 +210,7 @@ class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-
                     <input type="url"
                            id="social_bluesky"
                            name="social_bluesky"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_bluesky'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_bluesky'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://bsky.app/profile/tuoprofilo') ?>">
                   </div>
@@ -221,7 +221,7 @@ class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-
                     <input type="url"
                            id="social_telegram"
                            name="social_telegram"
-                           value="<?php echo HtmlHelper::e((string)($appSettings['social_telegram'] ?? '')); ?>"
+                           value="<?php echo htmlspecialchars((string)($appSettings['social_telegram'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"
                            class="block w-full rounded-lg border-gray-300 focus:border-gray-500 focus:ring-gray-500 text-sm py-2 px-3"
                            placeholder="<?= __('https://t.me/tuocanale') ?>">
                   </div>