Merge branch 'develop' into trunk

app/Http/Controllers/InvoiceController.php

@@ -15,7 +15,6 @@ use Illuminate\Validation\ValidationException;
 use Kwaadpepper\CrudPolicies\Http\Requests\CrudIndexRequest;
 use Kwaadpepper\CrudPolicies\Traits\CrudController;
 use Kwaadpepper\Enum\Rules\EnumIsValidRule;
-use Symfony\Component\HttpFoundation\Response;
 
 /**
  * * Because update is denied when invoice is sent to the client
@@ -144,7 +143,8 @@ class InvoiceController extends Controller
     public function updateModel(Invoice &$model)
     {
         if ($model->signed_date) {
-            throw ValidationException::withMessages(['erreur' => trans('Il n\'est pas possible de mettre a jour un devis qui est signé')
+            throw ValidationException::withMessages([
+                'erreur' => trans('Il n\'est pas possible de mettre a jour un devis qui est signé')
             ]);
         }
         $this->validateTasks($model);
@@ -209,7 +209,7 @@ class InvoiceController extends Controller
      * @param \App\Models\Invoice $invoice
      * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function download(Invoice $invoice): Response
+    public function download(Invoice $invoice)
     {
         $this->authorize($invoice, 'download');
         return $invoice->generateInvoice()

app/Http/Controllers/TicketController.php

@@ -264,9 +264,8 @@ class TicketController extends Controller
                     $ticket->file2 = ToolboxHelper::storeImage($ticket->getTable(), $fileTicket2);
                 }
 
-                if ($request->labels) {
-                    $ticket->labels()->sync($request->labels);
-                }
+
+                $ticket->labels()->sync($request->labels);
 
                 $ticket->site()->associate($site);
                 $ticket->saveOrFail();

app/Http/Kernel.php

@@ -37,7 +37,7 @@ class Kernel extends HttpKernel
             \App\Http\Middleware\VerifyCsrfToken::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
             \App\Http\Middleware\SecureHeaders::class,
-            'xss'
+            'htmlsanitize'
         ]
     ];
 
@@ -59,6 +59,6 @@ class Kernel extends HttpKernel
         'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
-        'xss' => \App\Http\Middleware\XssSanitizer::class,
+        'htmlsanitize' => \App\Http\Middleware\HtmlSanitizer::class,
     ];
 }

app/Http/Middleware/HtmlSanitizer.php

@@ -5,7 +5,7 @@ namespace App\Http\Middleware;
 use App\Lib\ToolboxHelper;
 use Illuminate\Http\Request;
 
-class XssSanitizer
+class HtmlSanitizer
 {
     /**
      * Handle an incoming request.
@@ -18,11 +18,17 @@ class XssSanitizer
     public function handle(Request $request, \Closure $next, ...$params)
     {
         $inputs = $request->all();
-        array_walk_recursive($inputs, function (&$input, $name) use ($params) {
+        /** @var callable|null */
+        $cleanInput = null;
+        $cleanInput = function (&$input, $name, $rootName = null) use ($params, &$cleanInput) {
+            // * Nested element array
+            if (is_array($input)) {
+                array_walk_recursive($input, $cleanInput, $name);
+            }
             if (!is_string($input)) {
                 return;
             }
-            if (in_array($name, $params)) {
+            if (in_array($name, $params) or in_array($rootName ?? $name, $params)) {
                 // ? Is a json input ?
                 if ($isJson = \json_decode($input, true) and is_array($isJson)) {
                     // ! Decode each json field recursive.
@@ -39,7 +45,8 @@ class XssSanitizer
             } else {
                 $input = strip_tags($input);
             }
-        });
+        };
+        \array_walk($inputs, $cleanInput);
         $request->merge($inputs);
         return $next($request);
     }

app/Http/Requests/StoreTicket.php

@@ -40,6 +40,9 @@ class StoreTicket extends FormRequest
                 ]);
             }
         }
+        $this->merge([
+            'labels' => $this->labels ?? []
+        ]);
     }
 
 

routes/web.php

@@ -79,11 +79,11 @@ Route::middleware('auth:web')->group(function () {
     Route::resource('labels', LabelController::class)->except('show');
     Route::resource('brands', BrandController::class);
     Route::resource('sites', SiteController::class)
-    ->withoutMiddleware('xss')
-    ->middleware('xss:description,todo');
+    ->withoutMiddleware('htmlsanitize')
+    ->middleware('htmlsanitize:description,todo');
     Route::resource('projects', ProjectController::class)
-    ->withoutMiddleware('xss')
-    ->middleware('xss:description,todo');
+    ->withoutMiddleware('htmlsanitize')
+    ->middleware('htmlsanitize:description,todo');
     Route::resource('projects.macro_markers', MarkerController::class)
     ->parameters([
         'macro_markers' => 'marker'
@@ -117,9 +117,13 @@ Route::middleware('auth:web')->group(function () {
     // * LOGS and Files
     Route::resource('logs', LogController::class)->only('index');
     Route::resource('files', FileController::class)->only('index');
-    Route::resource('projects.logs', LogController::class);
+    Route::resource('projects.logs', LogController::class)
+    ->withoutMiddleware('htmlsanitize')
+    ->middleware('htmlsanitize:entry');
     Route::resource('projects.files', FileController::class);
-    Route::resource('sites.logs', LogController::class);
+    Route::resource('sites.logs', LogController::class)
+    ->withoutMiddleware('htmlsanitize')
+    ->middleware('htmlsanitize:entry');
     Route::resource('sites.files', FileController::class);
 
     // * INVOICES