From a783f7d8a4004be495a30cc5039f6f4618f7794b Mon Sep 17 00:00:00 2001
From: Peter Goodhall <peter@magicbug.co.uk>
Date: Tue, 15 Jul 2025 14:31:53 +0100
Subject: [PATCH] Security bug fixes

---
 application/models/Eqsl_images.php          |  7 ++++++-
 application/models/Eqslmethods_model.php    | 14 ++++++++++++--
 application/models/User_model.php           |  2 +-
 application/views/logbookadvanced/index.php |  4 ++++
 assets/js/sections/logbookadvanced.js       | 15 +++++++++++++++
 5 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/application/models/Eqsl_images.php b/application/models/Eqsl_images.php
index dcd16092..dc5c9c6b 100644
--- a/application/models/Eqsl_images.php
+++ b/application/models/Eqsl_images.php
@@ -30,7 +30,12 @@ class Eqsl_images extends CI_Model {
 		$this->db->select('COL_PRIMARY_KEY, qso_id, COL_CALL, COL_MODE, , COL_SUBMODE, COL_TIME_ON, COL_BAND, COL_SAT_NAME, image_file');
 		$this->db->join($this->config->item('table_name'), 'qso_id = COL_PRIMARY_KEY', 'left outer');
 		$this->db->join('station_profile', $this->config->item('table_name').'.station_id = station_profile.station_id', 'left outer');
-		$this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+		if (!empty($logbooks_locations_array)) {
+			$this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+		} else {
+			// Option 1: Prevent query and return empty result
+			return [];
+		}
 		$this->db->order_by('COL_TIME_ON', 'DESC');
 		return $this->db->get('eQSL_images');
 	}
diff --git a/application/models/Eqslmethods_model.php b/application/models/Eqslmethods_model.php
index 4d782f5b..3f410fc1 100644
--- a/application/models/Eqslmethods_model.php
+++ b/application/models/Eqslmethods_model.php
@@ -63,7 +63,12 @@ class Eqslmethods_model extends CI_Model {
         $this->db->or_where($this->config->item('table_name').'.COL_EQSL_QSL_SENT', 'Q');
         $this->db->or_where($this->config->item('table_name').'.COL_EQSL_QSL_SENT', 'N');
         $this->db->group_end();
-        $this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+        if (!empty($logbooks_locations_array)) {
+            $this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+        } else {
+            // Option 1: Skip the query altogether (return no results)
+            return [];
+        }
 
         return $this->db->get();
     }
@@ -91,7 +96,12 @@ class Eqslmethods_model extends CI_Model {
         $this->db->where($this->config->item('table_name').'.COL_CALL !=', '');
         $this->db->where($this->config->item('table_name').'.COL_EQSL_QSL_RCVD', 'Y');
         $this->db->where('qso_id', NULL);
-        $this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+        if (!empty($logbooks_locations_array)) {
+            $this->db->where_in('station_profile.station_id', $logbooks_locations_array);
+        } else {
+            // Option 1: Skip the query altogether (return no results)
+            return [];
+        }
         $this->db->order_by("COL_TIME_ON", "desc");
 
         return $this->db->get();
diff --git a/application/models/User_model.php b/application/models/User_model.php
index 731f26c9..528b15ea 100644
--- a/application/models/User_model.php
+++ b/application/models/User_model.php
@@ -266,7 +266,7 @@ class User_Model extends CI_Model {
 					'user_quicklog' => xss_clean($fields['user_quicklog']),
 					'user_quicklog_enter' => xss_clean($fields['user_quicklog_enter']),
 					'language' => xss_clean($fields['language']),
-					'winkey' => isset($fields['user_winkey']) ? xss_clean($fields['user_winkey']) : 0,
+					'winkey' => (isset($fields['user_winkey']) && is_numeric($clean = xss_clean($fields['user_winkey'])) && $clean !== '') ? intval($clean) : 0,
 					'winkey_websocket' => isset($fields['user_winkey_websocket']) ? xss_clean($fields['user_winkey_websocket']) : 0,
 				);
 
diff --git a/application/views/logbookadvanced/index.php b/application/views/logbookadvanced/index.php
index c2a3bd0b..35d5e367 100644
--- a/application/views/logbookadvanced/index.php
+++ b/application/views/logbookadvanced/index.php
@@ -20,6 +20,10 @@ if (!isset($options->operator)) {
 }
 ?>
 </script>
+<script>
+    const CSRF_NAME = '<?= $this->security->get_csrf_token_name(); ?>';
+    const CSRF_HASH = '<?= $this->security->get_csrf_hash(); ?>';
+</script>
 <style>
 /*Legend specific*/
 .legend {
diff --git a/assets/js/sections/logbookadvanced.js b/assets/js/sections/logbookadvanced.js
index 0c8a6fa5..90437305 100644
--- a/assets/js/sections/logbookadvanced.js
+++ b/assets/js/sections/logbookadvanced.js
@@ -2,6 +2,21 @@ var callBookProcessingDialog = null;
 var inCallbookProcessing = false;
 var inCallbookItemProcessing = false;
 
+// Ensure CSRF token is included in all POST requests
+if (typeof CSRF_NAME !== 'undefined' && typeof CSRF_HASH !== 'undefined') {
+    $.ajaxSetup({
+        beforeSend: function(xhr, settings) {
+            if (settings.type === 'POST') {
+                if (typeof settings.data === 'string') {
+                    settings.data += '&' + encodeURIComponent(CSRF_NAME) + '=' + encodeURIComponent(CSRF_HASH);
+                } else if (typeof settings.data === 'object') {
+                    settings.data[CSRF_NAME] = CSRF_HASH;
+                }
+            }
+        }
+    });
+}
+
 $('#band').change(function () {
 	var band = $("#band option:selected").text();
 	if (band != "SAT") {