Issue 8565: Sanitize input data

Fixes #8565

diff --git a/src/Model/GServer.php b/src/Model/GServer.php
index bc189af9d6bb7567ff531884ed214a2aaaca44c9..1eb7ec0e13a5dd1fc8b7420a62497399da0ad1b0 100644 (file)
--- a/src/Model/GServer.php
+++ b/src/Model/GServer.php
@@ -339,7 +339,7 @@ class GServer
         * @param string $server_url address of the server
         * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
-       private static function discoverRelay(string $server_url)
+       public static function discoverRelay(string $server_url)
        {
                Logger::info('Discover relay data', ['server' => $server_url]);
 
@@ -353,6 +353,15 @@ class GServer
                        return;
                }
 
+               // Sanitize incoming data, see https://github.com/friendica/friendica/issues/8565
+               $data['subscribe'] = (bool)$data['subscribe'] ?? false;
+
+               if (!$data['subscribe'] || empty($data['scope']) || !in_array(strtolower($data['scope']), ['all', 'tags'])) {
+                       $data['scope'] = '';
+                       $data['subscribe'] = false;
+                       $data['tags'] = [];
+               }
+
                $gserver = DBA::selectFirst('gserver', ['id', 'relay-subscribe', 'relay-scope'], ['nurl' => Strings::normaliseLink($server_url)]);
                if (!DBA::isResult($gserver)) {
                        return;