From 598a12aa2718afb8c69339048803bfece90fe0f2 Mon Sep 17 00:00:00 2001
From: Miguel Ribeiro <k.d.mintnick@gmail.com>
Date: Fri, 11 Oct 2024 18:45:27 +0200
Subject: [PATCH] fix: xss issue on the dashboard

---
 calendar.php                    | 2 +-
 endpoints/subscriptions/get.php | 6 +++---
 includes/version.php            | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/calendar.php b/calendar.php
index bb7f71d84..b54388b03 100644
--- a/calendar.php
+++ b/calendar.php
@@ -218,7 +218,7 @@ class="fa-solid fa-chevron-right"></i></button>
                       if (date('d', $date) == $day) {
                         ?>
                         <div class="calendar-subscription-title" onClick="openSubscriptionModal(<?= $subscription['id'] ?>)">
-                          <?= htmlspecialchars($subscription['name']) ?>
+                          <?= $subscription['name'] ?>
                         </div>
                         <?php
                       }
diff --git a/endpoints/subscriptions/get.php b/endpoints/subscriptions/get.php
index 2614f50fb..30de06afb 100644
--- a/endpoints/subscriptions/get.php
+++ b/endpoints/subscriptions/get.php
@@ -146,7 +146,7 @@
     $id = $subscription['id'];
     $print[$id]['id'] = $id;
     $print[$id]['logo'] = $subscription['logo'] != "" ? "images/uploads/logos/" . $subscription['logo'] : "";
-    $print[$id]['name'] = htmlspecialchars_decode($subscription['name'] ?? "");
+    $print[$id]['name'] = $subscription['name'] ?? "";
     $cycle = $subscription['cycle'];
     $frequency = $subscription['frequency'];
     $print[$id]['billing_cycle'] = getBillingCycle($cycle, $frequency, $i18n);
@@ -164,8 +164,8 @@
     $print[$id]['payer_user_id'] = $subscription['payer_user_id'];
     $print[$id]['price'] = floatval($subscription['price']);
     $print[$id]['inactive'] = $subscription['inactive'];
-    $print[$id]['url'] = htmlspecialchars_decode($subscription['url'] ?? "");
-    $print[$id]['notes'] = htmlspecialchars_decode($subscription['notes'] ?? "");
+    $print[$id]['url'] = $subscription['url'] ?? "";
+    $print[$id]['notes'] = $subscription['notes'] ?? "";
 
     if (isset($settings['convertCurrency']) && $settings['convertCurrency'] === 'true' && $currencyId != $mainCurrencyId) {
       $print[$id]['price'] = getPriceConverted($print[$id]['price'], $currencyId, $db);
diff --git a/includes/version.php b/includes/version.php
index e5a44f1e4..5efb522b9 100644
--- a/includes/version.php
+++ b/includes/version.php
@@ -1,3 +1,3 @@
 <?php
-$version = "v2.29.0";
+$version = "v2.29.2";
 ?>
\ No newline at end of file