diff --git a/phpmyfaq/api.service.php b/phpmyfaq/api.service.php index 1b7848f5ce..d237171c39 100644 --- a/phpmyfaq/api.service.php +++ b/phpmyfaq/api.service.php @@ -771,14 +771,30 @@ $author = trim((string) Filter::filterVar($postData['name'], FILTER_SANITIZE_SPECIAL_CHARS)); $email = Filter::filterVar($postData['email'], FILTER_VALIDATE_EMAIL); - $link = trim((string) Filter::filterVar($postData['link'], FILTER_VALIDATE_URL)); $attached = trim((string) Filter::filterVar($postData['message'], FILTER_SANITIZE_SPECIAL_CHARS)); $mailto = Filter::filterArray($postData['mailto[]']); + $faqLanguage = trim((string) Filter::filterVar($postData['lang'], FILTER_SANITIZE_SPECIAL_CHARS)); + $faqId = trim((string) Filter::filterVar($postData['faqId'], FILTER_VALIDATE_INT)); + $categoryId = trim((string) Filter::filterVar($postData['categoryId'], FILTER_VALIDATE_INT)); + + if (is_array($mailto) && count($mailto) > 5) { + $response->setStatusCode(Response::HTTP_BAD_REQUEST); + $response->setData(['error' => Translation::get('err_sendMail')]); + break; + } + if ( !is_null($author) && !is_null($email) && is_array($mailto) && $stopWords->checkBannedWord(Strings::htmlspecialchars($attached)) ) { + $send2friendLink = sprintf( + '%sindex.php?action=faq&cat=%d&id=%d&artlang=%s', + $faqConfig->getDefaultUrl(), + $categoryId, + $faqId, + urlencode($faqLanguage) + ); foreach ($mailto as $recipient) { $recipient = trim(strip_tags((string) $recipient)); @@ -796,8 +812,8 @@ "%s\r\n\r\n%s\r\n%s\r\n\r\n%s", $faqConfig->get('main.send2friendText'), Translation::get('msgS2FText2'), - $link, - $attached + $send2friendLink, + strip_tags($attached) ); // Send the email diff --git a/phpmyfaq/assets/themes/default/templates/send2friend.html b/phpmyfaq/assets/themes/default/templates/send2friend.html index 1fc4eab7f5..d5f349245c 100644 --- a/phpmyfaq/assets/themes/default/templates/send2friend.html +++ b/phpmyfaq/assets/themes/default/templates/send2friend.html @@ -9,8 +9,10 @@