Merge pull request #29 from funktechno/f/scan

php code scan

.github/workflows/pslam.yml

@@ -0,0 +1,28 @@
+name: Psalm Security Scan
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+
+jobs:
+  psalm:
+    name: Psalm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Psalm Security Scan
+        uses: docker://ghcr.io/psalm/psalm-security-scan
+        with:
+          security_analysis: true
+          report_file: results.sarif
+          composer_require_dev: true
+
+      - name: Upload Security Analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: results.sarif

view/login.php

@@ -33,7 +33,7 @@
         <em>Passwords must be at least 8 characters and contain at least 1 number, 1 capital letter, and 1 special character</em>
         <br>
 
-        <input type="password" name="clientPassword" id="clientPassword" pattern="(?=^.{8,}$)(?=.*\d)(?=.*\W+)(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" <?php echo (isset($clientPassword)) ? "value='$clientPassword'" : "" ?> required>
+        <input type="password" name="clientPassword" id="clientPassword" pattern="(?=^.{8,}$)(?=.*\d)(?=.*\W+)(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" <?php echo htmlentities(isset($clientPassword) ? "value='$clientPassword'" : "") ?> required>
         <br>
 
         <!-- <button class="btn red" type="submit">Login</button> -->

view/registration.php

@@ -34,7 +34,7 @@
         <em>Passwords must be at least 8 characters and contain at least 1 number, 1 capital letter, and 1 special character</em>
         <br>
 
-        <input type="password" name="clientPassword" id="clientPassword" <?php echo (isset($clientPassword)) ? "value='$clientPassword'" : "" ?>  pattern="(?=^.{8,}$)(?=.*\d)(?=.*\W+)(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" required>
+        <input type="password" name="clientPassword" id="clientPassword" <?php echo htmlentities(isset($clientPassword) ? "value='$clientPassword'" : "") ?>  pattern="(?=^.{8,}$)(?=.*\d)(?=.*\W+)(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" required>
         <br>
         <!-- <button class=" btn red" type="submit">Register</button> -->
         <input type="submit" class="btn red" name="submit" id="regbtn" value="Register">