| @@ -1,8 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace FluentBoards\App\Http\Controllers; |
| 4 | 4 | |
| 5 | +use FluentBoards\Framework\Database\Orm\ModelNotFoundException; | |
| 5 | 6 | use FluentBoards\App\Models\Meta; |
| 6 | 7 | use FluentBoards\App\Models\Stage; |
| 7 | 8 | use FluentBoards\App\Models\Task; |
| 8 | 9 | use FluentBoards\App\Models\Board; |
| @@ -439,13 +440,32 @@ | ||
| 439 | 440 | } |
| 440 | 441 | } |
| 441 | 442 | } |
| 442 | 443 | |
| 443 | - | |
| 444 | + /** | |
| 445 | + * Create a task with field-specific sanitization for its request data. | |
| 446 | + * | |
| 447 | + * @param Request $request | |
| 448 | + * @param int $board_id | |
| 449 | + * @return mixed | |
| 450 | + */ | |
| 444 | 451 | public function create(Request $request, $board_id) |
| 445 | 452 | { |
| 446 | 453 | $board_id = absint($board_id); |
| 447 | - $taskData = $this->taskSanitizeAndValidate($request->getSafe('task'), [ | |
| 454 | + $safeTaskData = $request->getSafe('task'); | |
| 455 | + $rawTaskData = $request->get('task', []); | |
| 456 | + | |
| 457 | + // Milkdown serializes pasted URLs as <https://...>, which generic text | |
| 458 | + // sanitization removes as a tag. | |
| 459 | + if ( | |
| 460 | + is_array($safeTaskData) && | |
| 461 | + is_array($rawTaskData) && | |
| 462 | + array_key_exists('description', $rawTaskData) | |
| 463 | + ) { | |
| 464 | + $safeTaskData['description'] = fluent_boards_sanitize_description($rawTaskData['description']); | |
| 465 | + } | |
| 466 | + | |
| 467 | + $taskData = $this->taskSanitizeAndValidate($safeTaskData, [ | |
| 448 | 468 | 'title' => 'required|string', |
| 449 | 469 | 'board_id' => 'required|numeric', |
| 450 | 470 | 'stage_id' => 'required|numeric', |
| 451 | 471 | 'priority' => 'nullable|string', |
| @@ -522,8 +542,10 @@ | ||
| 522 | 542 | return [ |
| 523 | 543 | 'task' => $task |
| 524 | 544 | ]; |
| 525 | 545 | |
| 546 | + } catch (ModelNotFoundException $e) { | |
| 547 | + throw $e; | |
| 526 | 548 | } catch (\Exception $e ) { |
| 527 | 549 | return $this->sendError($e->getMessage(), 400); |
| 528 | 550 | } |
| 529 | 551 | |
