Release 2.53 (#5878)

src/Validator/Constraints/NoHtmlSpecialCharacters.php

@@ -0,0 +1,29 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Validator\Constraints;
+
+use Symfony\Component\Validator\Constraint;
+
+#[\Attribute(\Attribute::TARGET_PROPERTY)]
+final class NoHtmlSpecialCharacters extends Constraint
+{
+    public const SPECIAL_CHARACTERS_FOUND = 'kimai-html-character-001';
+
+    protected const ERROR_NAMES = [
+        self::SPECIAL_CHARACTERS_FOUND => 'These characters are not allowed: {{ chars }}',
+    ];
+
+    public string $message = 'These characters are not allowed: {{ chars }}';
+
+    public function getTargets(): string
+    {
+        return self::PROPERTY_CONSTRAINT;
+    }
+}

src/Validator/Constraints/NoHtmlSpecialCharactersValidator.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Validator\Constraints;
+
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidator;
+use Symfony\Component\Validator\Exception\UnexpectedTypeException;
+
+final class NoHtmlSpecialCharactersValidator extends ConstraintValidator
+{
+    public function validate(mixed $value, Constraint $constraint): void
+    {
+        if (!($constraint instanceof NoHtmlSpecialCharacters)) {
+            throw new UnexpectedTypeException($constraint, NoHtmlSpecialCharacters::class);
+        }
+
+        if (!\is_string($value)) {
+            return;
+        }
+
+        if (str_contains($value, '<')
+            || str_contains($value, '>')
+            || str_contains($value, '"')
+            // there are many family names that use the ' (like O'Hara), so we cannot forbid them
+        ) {
+            $this->context->buildViolation(NoHtmlSpecialCharacters::getErrorName(NoHtmlSpecialCharacters::SPECIAL_CHARACTERS_FOUND))
+                ->setTranslationDomain('validators')
+                ->setParameter('{{ chars }}', '< " >')
+                ->setCode(NoHtmlSpecialCharacters::SPECIAL_CHARACTERS_FOUND)
+                ->addViolation();
+        }
+    }
+}