From 81d9568d004947c9ffbadf4543c61a8035bb674d Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Thu, 16 Jan 2025 19:58:28 +0100
Subject: [PATCH 1/5] fix: corrected column length in faqforms table

---
 .../src/phpMyFAQ/Instance/Database/Mysqli.php |  2 +-
 .../src/phpMyFAQ/Instance/Database/Pgsql.php  |  2 +-
 .../phpMyFAQ/Instance/Database/Sqlite3.php    |  2 +-
 .../src/phpMyFAQ/Instance/Database/Sqlsrv.php |  2 +-
 phpmyfaq/src/phpMyFAQ/Setup/Update.php        | 62 +++++++++++++++++++
 5 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/phpmyfaq/src/phpMyFAQ/Instance/Database/Mysqli.php b/phpmyfaq/src/phpMyFAQ/Instance/Database/Mysqli.php
index 77ad35fa80..bf76a6e96e 100644
--- a/phpmyfaq/src/phpMyFAQ/Instance/Database/Mysqli.php
+++ b/phpmyfaq/src/phpMyFAQ/Instance/Database/Mysqli.php
@@ -208,7 +208,7 @@ class Mysqli extends Database implements Driver
             form_id INT(1) NOT NULL,
             input_id INT(11) NOT NULL,
             input_type VARCHAR(1000) NOT NULL,
-            input_label VARCHAR(100) NOT NULL,
+            input_label VARCHAR(500) NOT NULL,
             input_active INT(1) NOT NULL,
             input_required INT(1) NOT NULL,
             input_lang VARCHAR(11) NOT NULL)',
diff --git a/phpmyfaq/src/phpMyFAQ/Instance/Database/Pgsql.php b/phpmyfaq/src/phpMyFAQ/Instance/Database/Pgsql.php
index f66bb26b00..19ce01eb53 100644
--- a/phpmyfaq/src/phpMyFAQ/Instance/Database/Pgsql.php
+++ b/phpmyfaq/src/phpMyFAQ/Instance/Database/Pgsql.php
@@ -208,7 +208,7 @@ class Pgsql extends Database implements Driver
             form_id INTEGER NOT NULL,
             input_id INTEGER NOT NULL,
             input_type VARCHAR(1000) NOT NULL,
-            input_label VARCHAR(100) NOT NULL,
+            input_label VARCHAR(500) NOT NULL,
             input_active INTEGER NOT NULL,
             input_required INTEGER NOT NULL,
             input_lang VARCHAR(11) NOT NULL)',
diff --git a/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlite3.php b/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlite3.php
index 495b06d0cf..178b9d0e5a 100644
--- a/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlite3.php
+++ b/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlite3.php
@@ -204,7 +204,7 @@ class Sqlite3 extends Database implements Driver
             form_id INTEGER NOT NULL,
             input_id INTEGER NOT NULL,
             input_type VARCHAR(1000) NOT NULL,
-            input_label VARCHAR(100) NOT NULL,
+            input_label VARCHAR(500) NOT NULL,
             input_active INTEGER NOT NULL,
             input_required INTEGER NOT NULL,
             input_lang VARCHAR(11) NOT NULL)',
diff --git a/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlsrv.php b/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlsrv.php
index f4368fdf93..da6fdd4558 100644
--- a/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlsrv.php
+++ b/phpmyfaq/src/phpMyFAQ/Instance/Database/Sqlsrv.php
@@ -204,7 +204,7 @@ class Sqlsrv extends Database implements Driver
             form_id INTEGER NOT NULL,
             input_id INTEGER NOT NULL,
             input_type NVARCHAR(1000) NOT NULL,
-            input_label NVARCHAR(100) NOT NULL,
+            input_label NVARCHAR(500) NOT NULL,
             input_active INTEGER NOT NULL,
             input_required INTEGER NOT NULL,
             input_lang NVARCHAR(11) NOT NULL)',
diff --git a/phpmyfaq/src/phpMyFAQ/Setup/Update.php b/phpmyfaq/src/phpMyFAQ/Setup/Update.php
index f5cf1e3cbd..789ed8df25 100644
--- a/phpmyfaq/src/phpMyFAQ/Setup/Update.php
+++ b/phpmyfaq/src/phpMyFAQ/Setup/Update.php
@@ -165,6 +165,7 @@ public function applyUpdates(): bool
         $this->applyUpdates400Alpha2();
         $this->applyUpdates400Alpha3();
         $this->applyUpdates400Beta2();
+        $this->applyUpdates405();
 
         // Optimize the tables
         $this->optimizeTables();
@@ -860,6 +861,67 @@ private function applyUpdates400Beta2(): void
         }
     }
 
+    private function applyUpdates405(): void
+    {
+        if (version_compare($this->version, '4.0.5', '<')) {
+            switch (Database::getType()) {
+                case 'mysqli':
+                    $this->queries[] = sprintf(
+                        'ALTER TABLE %sfaqforms CHANGE input_label input_label VARCHAR(500) NOT NULL',
+                        Database::getTablePrefix()
+                    );
+                    break;
+                case 'pgsql':
+                    $this->queries[] = sprintf(
+                        'ALTER TABLE %sfaqforms ALTER COLUMN input_label TYPE VARCHAR(500)',
+                        Database::getTablePrefix()
+                    );
+                    $this->queries[] = sprintf(
+                        'ALTER TABLE %sfaqforms ALTER COLUMN input_label SET NOT NULL',
+                        Database::getTablePrefix()
+                    );
+                    break;
+                case 'sqlite3':
+                    $this->queries[] = sprintf(
+                        'ALTER TABLE %sfaqforms RENAME TO %sfaqforms_old',
+                        Database::getTablePrefix(),
+                        Database::getTablePrefix()
+                    );
+                    $this->queries[] = sprintf(
+                        'CREATE TABLE %sfaqforms (
+                            form_id INTEGER NOT NULL,
+                            input_id INTEGER NOT NULL,
+                            input_type VARCHAR(1000) NOT NULL,
+                            input_label VARCHAR(500) NOT NULL,
+                            input_active INTEGER NOT NULL,
+                            input_required INTEGER NOT NULL,
+                            input_lang VARCHAR(11) NOT NULL
+                        )',
+                        Database::getTablePrefix()
+                    );
+                    $this->queries[] = sprintf(
+                        'INSERT INTO %sfaqforms 
+                            SELECT 
+                                form_id, input_id, input_type, input_label, input_active, input_required, input_lang 
+                            FROM %sfaqforms_old',
+                        Database::getTablePrefix(),
+                        Database::getTablePrefix()
+                    );
+                    $this->queries[] = sprintf(
+                        'DROP TABLE %sfaqforms_old;',
+                        Database::getTablePrefix()
+                    );
+                    break;
+                case 'sqlsrv':
+                    $this->queries[] = sprintf(
+                        'ALTER TABLE %sfaqforms ALTER COLUMN input_label NVARCHAR(500) NOT NULL',
+                        Database::getTablePrefix()
+                    );
+                    break;
+            }
+        }
+    }
+
     private function updateVersion(): void
     {
         $this->configuration->update(['main.currentApiVersion' => System::getApiVersion()]);

From 793877b9bd6f358c36a65612d2fba307b4fad165 Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Fri, 17 Jan 2025 17:10:59 +0100
Subject: [PATCH 2/5] fix: corrected check on captcha after displaying smart
 answer

---
 phpmyfaq/assets/src/search/question.js        |  4 +++
 phpmyfaq/assets/templates/default/ask.twig    | 19 +++++++-----
 .../Frontend/QuestionController.php           | 31 +++++++++----------
 3 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/phpmyfaq/assets/src/search/question.js b/phpmyfaq/assets/src/search/question.js
index 0bc7d76ac0..985fae3e85 100644
--- a/phpmyfaq/assets/src/search/question.js
+++ b/phpmyfaq/assets/src/search/question.js
@@ -47,6 +47,10 @@ export const handleQuestion = () => {
           message.insertAdjacentElement('afterend', addElement('div', { classList: '', innerHTML: resultMessage }));
           // Add hidden input
           form.insertAdjacentElement('afterbegin', addElement('input', { type: 'hidden', name: 'save', value: 1 }));
+          form.insertAdjacentElement(
+            'afterbegin',
+            addElement('input', { type: 'hidden', name: 'store', value: 'now' })
+          );
         }
 
         // Final result
diff --git a/phpmyfaq/assets/templates/default/ask.twig b/phpmyfaq/assets/templates/default/ask.twig
index 5f5a567236..5dc714bda9 100644
--- a/phpmyfaq/assets/templates/default/ask.twig
+++ b/phpmyfaq/assets/templates/default/ask.twig
@@ -31,16 +31,18 @@
     <input type="hidden" name="lang" id="lang" value="{{ lang }}">
 
     <div class="row mb-2">
-      <label class="col-sm-3 col-form-label" for="name">{{ id3_label }}:
-        <span style="color: red"> *</span></label>
+      <label class="col-sm-3 col-form-label" for="name">
+        {{ id3_label }}*:
+      </label>
       <div class="col-sm-9">
         <input type="text" class="form-control" name="name" id="name" value="{{ defaultContentName }}" required>
       </div>
     </div>
 
     <div class="row mb-2">
-      <label class="col-sm-3 col-form-label" for="email">{{ id4_label }}:
-        <span style="color: red"> *</span></label>
+      <label class="col-sm-3 col-form-label" for="email">
+        {{ id4_label }}*:
+      </label>
       <div class="col-sm-9">
         <input type="email" class="form-control" name="email" id="email" value="{{ defaultContentMail }}" required>
       </div>
@@ -48,8 +50,8 @@
 
     {% if id5_label is defined %}
     <div class="row mb-2">
-      <label class="col-sm-3 col-form-label" for="category">{{ id5_label }}:
-      {% if id5_required == 'required' %}<span style="color: red"> *</span>{% endif %}
+      <label class="col-sm-3 col-form-label" for="category">
+        {{ id5_label }}{% if id5_required == 'required' %}*{% endif %}:
       </label>
       <div class="col-sm-9">
         <select name="category" class="form-select" id="category" {{ id5_required }}>
@@ -60,8 +62,9 @@
     {% endif %}
 
     <div class="row mb-2">
-      <label class="col-sm-3 col-form-label" for="question">{{ id6_label }}:
-        <span style="color: red"> *</span></label>
+      <label class="col-sm-3 col-form-label" for="question">
+        {{ id6_label }}*:
+      </label>
       <div class="col-sm-9">
         <textarea class="form-control" cols="45" rows="5" name="question" id="question" required></textarea>
       </div>
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Frontend/QuestionController.php b/phpmyfaq/src/phpMyFAQ/Controller/Frontend/QuestionController.php
index 419a7dadbd..007fa3a490 100644
--- a/phpmyfaq/src/phpMyFAQ/Controller/Frontend/QuestionController.php
+++ b/phpmyfaq/src/phpMyFAQ/Controller/Frontend/QuestionController.php
@@ -46,9 +46,7 @@ class QuestionController extends AbstractController
      */
     public function create(Request $request): JsonResponse
     {
-        $user = CurrentUser::getCurrentUser($this->configuration);
-
-        if (!$this->isAddingQuestionsAllowed($user)) {
+        if (!$this->isAddingQuestionsAllowed()) {
             return $this->json(['error' => Translation::get('ad_msg_noauth')], Response::HTTP_FORBIDDEN);
         }
 
@@ -69,14 +67,15 @@ public function create(Request $request): JsonResponse
         $selectedCategory = isset($data->category) ? Filter::filterVar($data->category, FILTER_VALIDATE_INT) : false;
         $userQuestion = trim(strip_tags((string) $data->question));
         $save = Filter::filterVar($data->save ?? 0, FILTER_VALIDATE_INT);
+        $storeNow = Filter::filterVar($data->store ?? 'not', FILTER_SANITIZE_SPECIAL_CHARS);
 
         // If smart answering is disabled, save the question immediately
         if (false === $this->configuration->get('main.enableSmartAnswering')) {
             $save = true;
         }
 
-        // Validate captcha
-        if (!$this->captchaCodeIsValid($request)) {
+        // Validate captcha if we can store the question after displaying the smart answer
+        if ($storeNow !== 'now' && !$this->captchaCodeIsValid($request)) {
             return $this->json(['error' => Translation::get('msgCaptcha')], Response::HTTP_BAD_REQUEST);
         }
 
@@ -108,7 +107,7 @@ public function create(Request $request): JsonResponse
                 $faqSearch->setCategoryId((int) $selectedCategory);
 
                 $faqPermission = new Permission($this->configuration);
-                $faqSearchResult = new SearchResultSet($user, $faqPermission, $this->configuration);
+                $faqSearchResult = new SearchResultSet($this->currentUser, $faqPermission, $this->configuration);
 
                 $searchResult = array_merge(...array_map(
                     fn($word) => $faqSearch->search($word, false),
@@ -134,16 +133,16 @@ public function create(Request $request): JsonResponse
         }
     }
 
-    private function isAddingQuestionsAllowed(CurrentUser $user): bool
+    /**
+     * @throws \Exception
+     */
+    private function isAddingQuestionsAllowed(): bool
     {
-        if (
-            !$this->configuration->get('records.allowQuestionsForGuests') &&
-            !$this->configuration->get('main.enableAskQuestions') &&
-            !$user->perm->hasPermission($user->getUserId(), PermissionType::QUESTION_ADD->value)
-        ) {
-            return false;
-        }
-
-        return true;
+        return $this->configuration->get('records.allowQuestionsForGuests') ||
+            $this->configuration->get('main.enableAskQuestions') ||
+            $this->currentUser->perm->hasPermission(
+                $this->currentUser->getUserId(),
+                PermissionType::QUESTION_ADD->value
+            );
     }
 }

From c5dd0254edf75e6c51e160512437f9ee5f1497bd Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Sat, 18 Jan 2025 08:01:21 +0100
Subject: [PATCH 3/5] fix: added missing delete queries for old section
 permissions

---
 phpmyfaq/src/phpMyFAQ/Setup/Update.php | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/phpmyfaq/src/phpMyFAQ/Setup/Update.php b/phpmyfaq/src/phpMyFAQ/Setup/Update.php
index 789ed8df25..5810129f59 100644
--- a/phpmyfaq/src/phpMyFAQ/Setup/Update.php
+++ b/phpmyfaq/src/phpMyFAQ/Setup/Update.php
@@ -864,6 +864,29 @@ private function applyUpdates400Beta2(): void
     private function applyUpdates405(): void
     {
         if (version_compare($this->version, '4.0.5', '<')) {
+            // Delete old permissions
+            $this->queries[] = sprintf(
+                'DELETE FROM %sfaqright WHERE name = \'view_sections\'',
+                Database::getTablePrefix()
+            );
+            $this->queries[] = sprintf(
+                'DELETE FROM %sfaqright WHERE name = \'add_section\'',
+                Database::getTablePrefix()
+            );
+            $this->queries[] = sprintf(
+                'DELETE FROM %sfaqright WHERE name = \'edit_section\'',
+                Database::getTablePrefix()
+            );
+            $this->queries[] = sprintf(
+                'DELETE FROM %sfaqright WHERE name = \'delete_section\'',
+                Database::getTablePrefix()
+            );
+            $this->queries[] = sprintf(
+                'DELETE FROM %sfaqright WHERE name = \'delete_section\'',
+                Database::getTablePrefix()
+            );
+
+            // Update faqforms table
             switch (Database::getType()) {
                 case 'mysqli':
                     $this->queries[] = sprintf(

From 0cec80c8195ecc2b7dc6fde5b4de324d35596f72 Mon Sep 17 00:00:00 2001
From: Jan <96944229+modelrailroader@users.noreply.github.com>
Date: Sat, 18 Jan 2025 10:24:14 +0100
Subject: [PATCH 4/5] fix: remove spaces before exploding to avoid errors with
 HTMLSanitizer

---
 phpmyfaq/src/phpMyFAQ/Configuration.php | 2 +-
 phpmyfaq/src/phpMyFAQ/Session.php       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpmyfaq/src/phpMyFAQ/Configuration.php b/phpmyfaq/src/phpMyFAQ/Configuration.php
index a6470f090d..21ec8d5890 100644
--- a/phpmyfaq/src/phpMyFAQ/Configuration.php
+++ b/phpmyfaq/src/phpMyFAQ/Configuration.php
@@ -515,7 +515,7 @@ public function replaceMainReferenceUrl(string $oldUrl, string $newUrl): bool
      */
     public function getAllowedMediaHosts(): array
     {
-        return explode(',', $this->get('records.allowedMediaHosts'));
+        return explode(',', trim($this->get('records.allowedMediaHosts')));
     }
 
     public function getCustomCss(): string
diff --git a/phpmyfaq/src/phpMyFAQ/Session.php b/phpmyfaq/src/phpMyFAQ/Session.php
index 39d95aa9a2..d86bbc2649 100644
--- a/phpmyfaq/src/phpMyFAQ/Session.php
+++ b/phpmyfaq/src/phpMyFAQ/Session.php
@@ -270,7 +270,7 @@ public function checkSessionId(int $sessionIdToCheck, string $ipAddress): void
      */
     private function getBotIgnoreList(): array
     {
-        return explode(',', (string) $this->configuration->get('main.botIgnoreList'));
+        return explode(',', trim((string) $this->configuration->get('main.botIgnoreList')));
     }
 
     /**

From a53df1f62f7453b5fefbf23e2ae0d8dbcd7874c3 Mon Sep 17 00:00:00 2001
From: Jan <96944229+modelrailroader@users.noreply.github.com>
Date: Sat, 18 Jan 2025 13:21:30 +0100
Subject: [PATCH 5/5] fix: let users edit faqs that are permitted to only one
 group

---
 phpmyfaq/src/phpMyFAQ/Faq/Permission.php | 36 +++++++++++++++++-------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/phpmyfaq/src/phpMyFAQ/Faq/Permission.php b/phpmyfaq/src/phpMyFAQ/Faq/Permission.php
index bd1b5feb02..0a4e8ebdd5 100644
--- a/phpmyfaq/src/phpMyFAQ/Faq/Permission.php
+++ b/phpmyfaq/src/phpMyFAQ/Faq/Permission.php
@@ -139,11 +139,19 @@ public function createPermissionArray(): array
                 'restricted_user' => [-1],
             ];
         } else {
-            $permissions += [
-                'restricted_user' => [
-                    Filter::filterVar($data->restricted_users, FILTER_VALIDATE_INT),
-                ],
-            ];
+            if (is_string($data->restricted_users)) {
+                $permissions += [
+                    'restricted_user' => [
+                        Filter::filterVar(array($data->restricted_users), FILTER_VALIDATE_INT),
+                    ],
+                ];
+            } else {
+                $permissions += [
+                    'restricted_user' => [
+                        Filter::filterVar($data->restricted_users, FILTER_VALIDATE_INT),
+                    ],
+                ];
+            }
         }
 
         if ('all' === Filter::filterVar($data->grouppermission, FILTER_SANITIZE_SPECIAL_CHARS)) {
@@ -151,11 +159,19 @@ public function createPermissionArray(): array
                 'restricted_groups' => [-1],
             ];
         } else {
-            $permissions += [
-                'restricted_groups' => [
-                    Filter::filterArray($data->{'restricted_groups'}, FILTER_VALIDATE_INT),
-                ]
-            ];
+            if (is_string($data->restricted_groups)) {
+                $permissions += [
+                    'restricted_groups' => [
+                        Filter::filterVar(array($data->restricted_groups), FILTER_VALIDATE_INT),
+                    ]
+                ];
+            } else {
+                $permissions += [
+                    'restricted_groups' => [
+                        Filter::filterArray($data->restricted_groups, FILTER_VALIDATE_INT),
+                    ]
+                ];
+            }
         }
 
         return $permissions;