From d82219eea04e4960eb9823b9bf7bea6978a5ebf0 Mon Sep 17 00:00:00 2001
From: Yasen Pramatarov <yasen@lindeas.com>
Date: Fri, 4 Oct 2024 18:13:55 +0300
Subject: [PATCH] bugfixes

---
 app/classes/database.php   |  2 +-
 app/helpers/pagination.php | 20 ++++++++++----------
 public_html/index.php      |  2 +-
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/classes/database.php b/app/classes/database.php
index a70a5f8..63c7449 100644
--- a/app/classes/database.php
+++ b/app/classes/database.php
@@ -66,7 +66,7 @@ class Database {
             $this->pdo = new PDO($dsn, $options['user'], $options['password'] ?? '');
             $this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
         } catch (PDOException $e) {
-            $error = getError('MySQL connection failed: ', $config['environment'], $e->getMessage());
+            $error = getError('MySQL connection failed: ', $e->getMessage(), $config['environment']);
         }
     }
 
diff --git a/app/helpers/pagination.php b/app/helpers/pagination.php
index d626de6..4346773 100644
--- a/app/helpers/pagination.php
+++ b/app/helpers/pagination.php
@@ -4,22 +4,22 @@
 <?php
     $param = '';
     if (isset($_REQUEST['id'])) {
-        $param .= '&id=' . $_REQUEST['id'];
+        $param .= '&id=' . htmlspecialchars($_REQUEST['id']);
     }
     if (isset($_REQUEST['name'])) {
-        $param .= '&name=' . $_REQUEST['name'];
+        $param .= '&name=' . htmlspecialchars($_REQUEST['name']);
     }
     if (isset($_REQUEST['ip'])) {
-        $param .= '&ip=' . $_REQUEST['ip'];
+        $param .= '&ip=' . htmlspecialchars($_REQUEST['ip']);
     }
     if (isset($_REQUEST['event'])) {
-        $param .= '&event=' . $_REQUEST['event'];
+        $param .= '&event=' . htmlspecialchars($_REQUEST['event']);
     }
     if (isset($_REQUEST['from_time'])) {
-        $param .= '&from_time=' . $from_time;
+        $param .= '&from_time=' . htmlspecialchars($from_time);
     }
     if (isset($_REQUEST['until_time'])) {
-        $param .= '&until_time=' . $until_time;
+        $param .= '&until_time=' . htmlspecialchars($until_time);
     }
 
     $max_visible_pages = 10;
@@ -47,20 +47,20 @@
             if ($i === $browse_page) {
                 // current page, no link
                 if ($browse_page > 1) {
-                    echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . htmlspecialchars($param) . '&p=' . (htmlspecialchars($browse_page) -1) . '"><<</a></span>';
+                    echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . $param . '&p=' . (htmlspecialchars($browse_page) -1) . '"><<</a></span>';
                 } else {
                     echo '<span><<</span>';
                 }
                 echo '[' . htmlspecialchars($i) . ']';
 
                 if ($browse_page < $page_count) {
-                    echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . htmlspecialchars($param) . '&p=' . (htmlspecialchars($browse_page) +1) . '">>></a></span>';
+                    echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . $param . '&p=' . (htmlspecialchars($browse_page) +1) . '">>></a></span>';
                 } else {
                     echo '<span>>></span>';
                 }
             } else {
                 // other pages
-                echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . htmlspecialchars($param) . '&p=' . htmlspecialchars($i) . '">[' . htmlspecialchars($i) . ']</a></span>';
+                echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . $param . '&p=' . htmlspecialchars($i) . '">[' . htmlspecialchars($i) . ']</a></span>';
             }
         // show ellipses between distant pages
         } elseif (
@@ -72,7 +72,7 @@
     }
 
     if ($browse_page < $page_count) {
-        echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . htmlspecialchars($param) . '&p=' . (htmlspecialchars($page_count)) . '">last</a></span>';
+        echo '<span><a href="' . htmlspecialchars($app_root) . '?platform=' . htmlspecialchars($platform_id) . '&page=' . htmlspecialchars($page) . $param . '&p=' . (htmlspecialchars($page_count)) . '">last</a></span>';
     } else {
         echo '<span>last</span>';
     }
diff --git a/public_html/index.php b/public_html/index.php
index 114f397..16fb0e4 100644
--- a/public_html/index.php
+++ b/public_html/index.php
@@ -68,7 +68,7 @@ if ($config_file) {
     die('Config file not found');
 }
 
-$app_root = htmlspecialchars($config['folder']);
+$app_root = $config['folder'];
 
 session_name('jilo');
 session_start();