From 90c5cdd97ca92e0f82e49c5cca5a27b93139eb7d Mon Sep 17 00:00:00 2001
From: Ferywir <65760459+Ferywir@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:59:00 +0200
Subject: [PATCH] fix(admin): escape reflected filter param in report/msg
 templates [#139] (#271)

---
 Admin/Templates/msg.tpl    | 4 ++--
 Admin/Templates/report.tpl | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Admin/Templates/msg.tpl b/Admin/Templates/msg.tpl
index a478fbee..ce0caefd 100644
--- a/Admin/Templates/msg.tpl
+++ b/Admin/Templates/msg.tpl
@@ -128,7 +128,7 @@ $msgs = $database->query("SELECT * FROM ".TB_PREFIX."mdata WHERE $where ORDER BY
     </div>
     <form class="search-box" method="get">
       <input type="hidden" name="p" value="msg">
-      <input type="hidden" name="f" value="<?php echo $filter;?>">
+      <input type="hidden" name="f" value="<?php echo htmlspecialchars($filter);?>">
       <input type="text" name="q" placeholder="Search..." value="<?php echo htmlspecialchars($search);?>">
     </form>
   </div>
@@ -162,7 +162,7 @@ $msgs = $database->query("SELECT * FROM ".TB_PREFIX."mdata WHERE $where ORDER BY
   <?php if($total > $limit){ $pages = ceil($total/$limit);?>
   <div class="pagination">
     <?php for($p=1;$p<=$pages && $p<=15;$p++){?>
-      <a href="?p=msg&page=<?php echo $p;?>&f=<?php echo $filter;?>&q=<?php echo urlencode($search);?>" class="<?php echo $p==$page?'active':'';?>"><?php echo $p;?></a>
+      <a href="?p=msg&page=<?php echo $p;?>&f=<?php echo urlencode($filter);?>&q=<?php echo urlencode($search);?>" class="<?php echo $p==$page?'active':'';?>"><?php echo $p;?></a>
     <?php }?>
   </div>
   <?php }?>
diff --git a/Admin/Templates/report.tpl b/Admin/Templates/report.tpl
index de58368f..27a57367 100644
--- a/Admin/Templates/report.tpl
+++ b/Admin/Templates/report.tpl
@@ -102,7 +102,7 @@ $typeNames = [1=>'reinforcement',2=>'attack',3=>'defence',4=>'scout',5=>'trade',
     </div>
     <form class="search-box" method="get">
       <input type="hidden" name="p" value="report">
-      <input type="hidden" name="f" value="<?php echo $filter;?>">
+      <input type="hidden" name="f" value="<?php echo htmlspecialchars($filter);?>">
       <input type="text" name="q" placeholder="Search..." value="<?php echo htmlspecialchars($search);?>">
     </form>
   </div>
@@ -134,7 +134,7 @@ $typeNames = [1=>'reinforcement',2=>'attack',3=>'defence',4=>'scout',5=>'trade',
   <?php if($total > $limit){ $pages = ceil($total/$limit);?>
   <div class="pagination">
     <?php for($p=1;$p<=$pages && $p<=15;$p++){?>
-      <a href="?p=report&page=<?php echo $p;?>&f=<?php echo $filter;?>&q=<?php echo urlencode($search);?>" class="<?php echo $p==$page?'active':'';?>"><?php echo $p;?></a>
+      <a href="?p=report&page=<?php echo $p;?>&f=<?php echo urlencode($filter);?>&q=<?php echo urlencode($search);?>" class="<?php echo $p==$page?'active':'';?>"><?php echo $p;?></a>
     <?php }?>
   </div>
   <?php }?>