force strip_tags() on all user input unless explicitly allowed

1 files changed, 13 insertions, 13 deletions

diff --git a/classes/pref/labels.php b/classes/pref/labels.php
index 8f1f70be9..38ec850a6 100644
--- a/classes/pref/labels.php
+++ b/classes/pref/labels.php
@@ -8,7 +8,7 @@ class Pref_Labels extends Handler_Protected {
 	}
 
 	function edit() {
-		$label_id = $_REQUEST['id'];
+		$label_id = clean($_REQUEST['id']);
 
 		$sth = $this->pdo->prepare("SELECT * FROM ttrss_labels2 WHERE
 			id = ? AND owner_uid = ?");
@@ -119,11 +119,11 @@ class Pref_Labels extends Handler_Protected {
 	}
 
 	function colorset() {
-		$kind = $_REQUEST["kind"];
-		$ids = explode(',', $_REQUEST["ids"]);
-		$color = $_REQUEST["color"];
-		$fg = $_REQUEST["fg"];
-		$bg = $_REQUEST["bg"];
+		$kind = clean($_REQUEST["kind"]);
+		$ids = explode(',', clean($_REQUEST["ids"]));
+		$color = clean($_REQUEST["color"]);
+		$fg = clean($_REQUEST["fg"]);
+		$bg = clean($_REQUEST["bg"]);
 
 		foreach ($ids as $id) {
 
@@ -154,7 +154,7 @@ class Pref_Labels extends Handler_Protected {
 	}
 
 	function colorreset() {
-		$ids = explode(',', $_REQUEST["ids"]);
+		$ids = explode(',', clean($_REQUEST["ids"]));
 
 		foreach ($ids as $id) {
 			$sth = $this->pdo->prepare("UPDATE ttrss_labels2 SET
@@ -174,8 +174,8 @@ class Pref_Labels extends Handler_Protected {
 
 	function save() {
 
-		$id = $_REQUEST["id"];
-		$caption = trim($_REQUEST["caption"]);
+		$id = clean($_REQUEST["id"]);
+		$caption = trim(clean($_REQUEST["caption"]));
 
 		$this->pdo->beginTransaction();
 
@@ -206,7 +206,7 @@ class Pref_Labels extends Handler_Protected {
 
 					$sth->execute([$caption, $old_caption, $_SESSION['uid']]);
 
-					print $_REQUEST["value"];
+					print clean($_REQUEST["value"]);
 				} else {
 					print $old_caption;
 				}
@@ -221,7 +221,7 @@ class Pref_Labels extends Handler_Protected {
 
 	function remove() {
 
-		$ids = explode(",", $_REQUEST["ids"]);
+		$ids = explode(",", clean($_REQUEST["ids"]));
 
 		foreach ($ids as $id) {
 			Labels::remove($id, $_SESSION["uid"]);
@@ -230,8 +230,8 @@ class Pref_Labels extends Handler_Protected {
 	}
 
 	function add() {
-		$caption = $_REQUEST["caption"];
-		$output = $_REQUEST["output"];
+		$caption = clean($_REQUEST["caption"]);
+		$output = clean($_REQUEST["output"]);
 
 		if ($caption) {