From fa470f39e6f88c2fb025205c38cdc61ee771e171 Mon Sep 17 00:00:00 2001
From: Rodolfo Berrios <20590102+rodber@users.noreply.github.com>
Date: Mon, 19 Jul 2021 17:07:31 -0400
Subject: [PATCH] close #95

---
 app/install/installer.php        |  1 +
 app/install/template/connect.php | 10 +++++-----
 app/install/template/ready.php   | 12 ++++++------
 3 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/app/install/installer.php b/app/install/installer.php
index 1176f46..042dace 100644
--- a/app/install/installer.php
+++ b/app/install/installer.php
@@ -934,6 +934,7 @@ WHERE NOT EXISTS (SELECT * FROM `%table_prefix%imports` WHERE `import_path`='%ro
     }
 
     if (!$installed_version && $_POST) {
+        $safe_post = G\Handler::getVar('safe_post');
         if (isset($_POST['username']) and !in_array($doing, ['already', 'update'])) {
             $doing = 'ready';
         }
diff --git a/app/install/template/connect.php b/app/install/template/connect.php
index f5d1cac..287d9af 100644
--- a/app/install/template/connect.php
+++ b/app/install/template/connect.php
@@ -14,23 +14,23 @@
 <form method="post" class="c9">
 	<div class="input-label">
 		<label for="db_host">Database host</label>
-		<input type="text" name="db_host" id="db_host" class="text-input" value="<?php echo isset($_POST['db_host']) ? $_POST['db_host'] : 'localhost'; ?>" placeholder="Usually localhost" title="Database server host (default: localhost)" rel="tooltip" data-tipTip="right" required>
+		<input type="text" name="db_host" id="db_host" class="text-input" value="<?php echo $safe_post['db_host'] ?? 'localhost'; ?>" placeholder="Usually localhost" title="Database server host (default: localhost)" rel="tooltip" data-tipTip="right" required>
 	</div>
 	<div class="input-label">
 		<label for="db_name">Database name</label>
-		<input type="text" name="db_name" id="db_name" class="text-input" value="<?php echo isset($_POST['db_name']) ? $_POST['db_name'] : ''; ?>" placeholder="Database name" title="Name of the database where you want to install Chevereto" rel="tooltip" data-tipTip="right" required>
+		<input type="text" name="db_name" id="db_name" class="text-input" value="<?php echo $safe_post['db_name'] ?? ''; ?>" placeholder="Database name" title="Name of the database where you want to install Chevereto" rel="tooltip" data-tipTip="right" required>
 	</div>
 	<div class="input-label">
 		<label for="db_user">Database user</label>
-		<input type="text" name="db_user" id="db_user" class="text-input" value="<?php echo isset($_POST['db_user']) ? $_POST['db_user'] : ''; ?>" placeholder="Database user" title="User with access to the above database" rel="tooltip" data-tipTip="right" required>
+		<input type="text" name="db_user" id="db_user" class="text-input" value="<?php echo $safe_post['db_user'] ?? ''; ?>" placeholder="Database user" title="User with access to the above database" rel="tooltip" data-tipTip="right" required>
 	</div>
 	<div class="input-label">
 		<label for="db_pass">Database user password</label>
-		<input type="text" name="db_pass" id="db_pass" class="text-input" value="<?php echo isset($_POST['db_pass']) ? $_POST['db_pass'] : ''; ?>" placeholder="Database user password" title="Password of the above user" rel="tooltip" data-tipTip="right">
+		<input type="text" name="db_pass" id="db_pass" class="text-input" value="<?php echo $safe_post['db_pass'] ?? ''; ?>" placeholder="Database user password" title="Password of the above user" rel="tooltip" data-tipTip="right">
 	</div>
 	<div class="input-label">
 		<label for="db_table_prefix">Database table prefix</label>
-		<input type="text" name="db_table_prefix" id="db_table_prefix" class="text-input" value="<?php echo isset($_POST['db_table_prefix']) ? $_POST['db_table_prefix'] : 'chv_'; ?>" placeholder="Usually chv_" title="Database table prefix. Use chv_ if you don't need this" rel="tooltip" data-tipTip="right">
+		<input type="text" name="db_table_prefix" id="db_table_prefix" class="text-input" value="<?php echo $safe_post['db_table_prefix'] ?? 'chv_'; ?>" placeholder="Usually chv_" title="Database table prefix. Use chv_ if you don't need this" rel="tooltip" data-tipTip="right">
 	</div>
 	<div class="btn-container margin-bottom-0">
 		<button class="btn btn-input default" type="submit">Continue</button>
diff --git a/app/install/template/ready.php b/app/install/template/ready.php
index a9da9c1..ee483d3 100644
--- a/app/install/template/ready.php
+++ b/app/install/template/ready.php
@@ -13,17 +13,17 @@
 	<div class="c9">
         <div class="input-label">
             <label for="username">Admin username</label>
-            <input type="text" name="username" id="username" class="text-input" value="<?php echo isset($_POST['username']) ? $_POST['username'] : null; ?>" placeholder="Admin username" rel="tooltip" data-tipTip="right" pattern="<?php echo CHV\getSetting('username_pattern'); ?>" rel="tooltip" title='<?php echo strtr('%i to %f characters<br>Letters, numbers and "_"', ['%i' => CHV\getSetting('username_min_length'), '%f' => CHV\getSetting('username_max_length')]); ?>' maxlength="<?php echo CHV\getSetting('username_max_length'); ?>" required>
+            <input type="text" name="username" id="username" class="text-input" value="<?php echo $safe_post['username'] ?? ''; ?>" placeholder="Admin username" rel="tooltip" data-tipTip="right" pattern="<?php echo CHV\getSetting('username_pattern'); ?>" rel="tooltip" title='<?php echo strtr('%i to %f characters<br>Letters, numbers and "_"', ['%i' => CHV\getSetting('username_min_length'), '%f' => CHV\getSetting('username_max_length')]); ?>' maxlength="<?php echo CHV\getSetting('username_max_length'); ?>" required>
             <span class="input-warning red-warning"><?php echo $input_errors['username']; ?></span>
         </div>
         <div class="input-label">
             <label for="email">Admin email</label>
-            <input type="email" name="email" id="email" class="text-input" value="<?php echo isset($_POST['email']) ? $_POST['email'] : ''; ?>" placeholder="Admin email" title="Valid email address for your admin account" rel="tooltip" data-tipTip="right" required>
+            <input type="email" name="email" id="email" class="text-input" value="<?php echo $safe_post['email'] ?? ''; ?>" placeholder="Admin email" title="Valid email address for your admin account" rel="tooltip" data-tipTip="right" required>
             <span class="input-warning red-warning"><?php echo $input_errors['email']; ?></span>
         </div>
         <div class="input-label input-password">
             <label for="password">Admin password</label>
-            <input type="password" name="password" id="password" class="text-input" value="<?php echo isset($_POST['password']) ? $_POST['password'] : ''; ?>" placeholder="Admin password" title="Password to login" pattern="<?php echo CHV\getSetting('user_password_pattern'); ?>" rel="tooltip" data-tipTip="right" required>
+            <input type="password" name="password" id="password" class="text-input" value="<?php echo $safe_post['password'] ?? ''; ?>" placeholder="Admin password" title="Password to login" pattern="<?php echo CHV\getSetting('user_password_pattern'); ?>" rel="tooltip" data-tipTip="right" required>
             <div class="input-password-strength"><span style="width: 0%" data-content="password-meter-bar"></span></div>
             <span class="input-warning red-warning" data-text="password-meter-message"><?php echo $input_errors['password']; ?></span>
         </div>
@@ -32,12 +32,12 @@
     <div class="c9">
         <div class="input-label">
             <label for="email_from_email"><?php _se('From email address'); ?></label>
-            <input type="email" name="email_from_email" id="email_from_email" class="text-input" value="<?php echo isset($_POST['email_from_email']) ? $_POST['email_from_email'] : ''; ?>" placeholder="no-reply@example.com" title="<?php _se('Sender email for emails sent to users.'); ?>" rel="tooltip" data-tipTip="right" required>
+            <input type="email" name="email_from_email" id="email_from_email" class="text-input" value="<?php echo $safe_post['email_from_email'] ?? ''; ?>" placeholder="no-reply@example.com" title="<?php _se('Sender email for emails sent to users.'); ?>" rel="tooltip" data-tipTip="right" required>
             <span class="input-warning red-warning"><?php echo $input_errors['email_from_email']; ?></span>
         </div>
         <div class="input-label">
             <label for="email_incoming_email"><?php _se('Incoming email address'); ?></label>
-            <input type="email" name="email_incoming_email" id="email_incoming_email" class="text-input" value="<?php echo isset($_POST['email_incoming_email']) ? $_POST['email_incoming_email'] : null; ?>" placeholder="inbox@example.com" title="<?php _se('Recipient for contact form and system alerts.'); ?>" rel="tooltip" data-tipTip="right" required>
+            <input type="email" name="email_incoming_email" id="email_incoming_email" class="text-input" value="<?php echo $safe_post['email_incoming_email'] ?? ''; ?>" placeholder="inbox@example.com" title="<?php _se('Recipient for contact form and system alerts.'); ?>" rel="tooltip" data-tipTip="right" required>
             <span class="input-warning red-warning"><?php echo $input_errors['email_incoming_email']; ?></span>
         </div>
     </div>
@@ -60,7 +60,7 @@
     <div class="c9">
         <div class="input-label">
             <label for="crypt_salt">__CHV_CRYPT_SALT__</label>
-            <input type="crypt_salt" name="crypt_salt" id="crypt_salt" class="text-input" value="<?php echo isset($_POST['crypt_salt']) ? $_POST['crypt_salt'] : ''; ?>" placeholder="Example: changeme" title="As defined in includes/definitions.php" rel="tooltip" data-tipTip="right" required>
+            <input type="crypt_salt" name="crypt_salt" id="crypt_salt" class="text-input" value="<?php echo $safe_post['crypt_salt'] ?? ''; ?>" placeholder="Example: changeme" title="As defined in includes/definitions.php" rel="tooltip" data-tipTip="right" required>
             <span class="input-below highlight">Value from define("__CHV_CRYPT_SALT__", "changeme");</span>
             <span class="input-warning red-warning"><?php echo $input_errors['crypt_salt']; ?></span>
         </div>