Trim comment text before persisting, not just for validation
Security / PHP Security (semgrep) (push) Successful in 2m6s
Lint / Deploy (push) Successful in 3s
Lint / PHP (phpcs PSR-12) (push) Successful in 26s
Lint / JS (eslint) (push) Successful in 11s
Lint / PHP requirements (version + extensions) (push) Successful in 29s
Lint / Notify on failure (push) Skipped
Security / PHP Security (semgrep) (push) Successful in 2m6s
Lint / Deploy (push) Successful in 3s
Lint / PHP (phpcs PSR-12) (push) Successful in 26s
Lint / JS (eslint) (push) Successful in 11s
Lint / PHP requirements (version + extensions) (push) Successful in 29s
Lint / Notify on failure (push) Skipped
add_comment.php computed a trimmed copy of comment_text only to check for empty input, then passed the original untrimmed $data through to CommentModel::addComment(), so any leading/trailing whitespace the user typed (or pasted) was written to ticket_comments.comment_text as-is. update_comment.php already trims before saving edits, so a comment could pass through this endpoint once with untrimmed text (creation) and be silently corrected the moment it was next edited — inconsistent storage that, combined with the markdown parser's line-anchored regexes (headings, tables, lists all match on ^), could make a markdown-enabled comment mis-render after a reload depending on whether its first line carried leading whitespace. Also trims in the "Load more comments" pagination re-render path in TicketView.php, matching the two on-load renderers in markdown.js so all three code paths that call parseMarkdown() on stored comment text treat leading whitespace consistently. Closes #18 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
@@ -99,6 +99,11 @@ try {
|
||||
exit;
|
||||
}
|
||||
|
||||
// Persist the trimmed text (not the raw client value) — matches update_comment.php
|
||||
// and keeps stored comment_text free of leading whitespace that could shift a
|
||||
// markdown-enabled comment's first line out of column 0 on reload.
|
||||
$data['comment_text'] = $commentTextRaw;
|
||||
|
||||
// Never trust a client-supplied display name — always attribute the comment to
|
||||
// the authenticated session user.
|
||||
$data['user_name'] = $currentUser['display_name'] ?? $currentUser['username'] ?? 'User';
|
||||
|
||||
Reference in New Issue
Block a user