From ec11da4e84c9ef000f05d8ea542e2fb9549d19a1 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sat, 11 Jun 2022 22:14:46 +0200
Subject: Safer htmlspecialchars_utf8 (#4411)

* Safer htmlspecialchars_utf8
#fix https://github.com/FreshRSS/FreshRSS/issues/4410

* Undefined variable
---
 app/Models/Context.php  | 3 +++
 app/layout/header.phtml | 5 +++--
 2 files changed, 6 insertions(+), 2 deletions(-)

(limited to 'app')

diff --git a/app/Models/Context.php b/app/Models/Context.php
index ce24c8e4c..55607f5c4 100644
--- a/app/Models/Context.php
+++ b/app/Models/Context.php
@@ -43,6 +43,7 @@ class FreshRSS_Context {
 	public static $state = 0;
 	public static $order = 'DESC';
 	public static $number = 0;
+	/** @var FreshRSS_BooleanSearch */
 	public static $search;
 	public static $first_id = '';
 	public static $next_id = '';
@@ -114,6 +115,8 @@ class FreshRSS_Context {
 			return false;
 		}
 
+		FreshRSS_Context::$search = new FreshRSS_BooleanSearch('');
+
 		//Legacy
 		$oldEntries = (int)FreshRSS_Context::$user_conf->param('old_entries', 0);
 		$keepMin = (int)FreshRSS_Context::$user_conf->param('keep_history_default', -5);
diff --git a/app/layout/header.phtml b/app/layout/header.phtml
index 94a83894e..21df02788 100644
--- a/app/layout/header.phtml
+++ b/app/layout/header.phtml
@@ -15,8 +15,9 @@
 		<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::$system_conf->allow_anonymous) { ?>
 		<form action="<?= _url('index', 'index') ?>" method="get">
 			<div class="stick">
-				<input type="search" name="search" id="search" class="extend" value="<?php
-					echo htmlspecialchars(htmlspecialchars_decode(FreshRSS_Context::$search, ENT_QUOTES), ENT_COMPAT, 'UTF-8'); ?>" placeholder="<?= _t('gen.menu.search') ?>" />
+				<input type="search" name="search" id="search" class="extend"
+					value="<?= htmlspecialchars(htmlspecialchars_decode(FreshRSS_Context::$search, ENT_QUOTES), ENT_COMPAT, 'UTF-8') ?>"
+					placeholder="<?= _t('gen.menu.search') ?>" />
 
 				<?php $get = Minz_Request::param('get', ''); ?>
 				<?php if ($get != '') { ?>
-- 
cgit v1.2.3