Prevent double escaping of multiline when cloning an item

fixes glpi-project#18123
Lainow · Oct 24, 2024 · bdde592 · bdde592
1 parent 26997c8
commit bdde592
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 5 deletions.
diff --git a/phpunit/functional/ProjectTest.php b/phpunit/functional/ProjectTest.php
@@ -37,6 +37,7 @@
 
 use DbTestCase;
 use Glpi\Team\Team;
+use Glpi\Toolbox\Sanitizer;
 use ProjectState;
 use ProjectTask;
 use ProjectTeam;
@@ -453,6 +454,40 @@ public function testClone()
         $this->assertEquals($expected, $tasks_clone);
     }
 
+    public function testCloneWithOverridenInput()
+    {
+        $project = $this->createItem(
+            'Project',
+            [
+                'name' => __FUNCTION__,
+            ]
+        );
+
+        $raw_description = <<<PLAINTEXT
+            > a
+            > multiline
+            > description
+PLAINTEXT;
+
+        $sanitized_description = <<<PLAINTEXT
+            &#62; a
+            &#62; multiline
+            &#62; description
+PLAINTEXT;
+
+        // Clone with raw input
+        $projects_id_clone = $project->clone(['content' => $raw_description]);
+        $project_clone = new \Project();
+        $this->assertTrue($project_clone->getFromDB($projects_id_clone));
+        $this->assertEquals($sanitized_description, $project_clone->fields['content']);
+
+        // Clone with already sanitized input
+        $projects_id_clone = $project->clone(Sanitizer::sanitize(['content' => $raw_description]));
+        $project_clone = new \Project();
+        $this->assertTrue($project_clone->getFromDB($projects_id_clone));
+        $this->assertEquals($sanitized_description, $project_clone->fields['content']);
+    }
+
     /**
      * Functional test to ensure that project's states colors are shown in
      * the search results

diff --git a/src/Features/Clonable.php b/src/Features/Clonable.php
@@ -37,8 +37,8 @@
 
 use CommonDBConnexity;
 use CommonDBTM;
+use Glpi\Toolbox\Sanitizer;
 use Session;
-use Toolbox;
 
 /**
  * Clonable objects
@@ -230,10 +230,9 @@ public function clone(array $override_input = [], bool $history = true)
             return false;
         }
         $new_item = new static();
-        $input = Toolbox::addslashes_deep($this->fields);
-        foreach ($override_input as $key => $value) {
-            $input[$key] = Toolbox::addslashes_deep($value);
-        }
+
+        $input = array_merge($this->fields, $override_input);
+        $input = Sanitizer::sanitize($input);
         $input = $new_item->cleanCloneInput($input);
 
         // Do not compute a clone name if a new name is specified (Like creating from template)