From 52e00216f73e52f5cf5b53483b5010537be00673 Mon Sep 17 00:00:00 2001
From: Ubuntu <ubuntu@ip-172-31-7-208.eu-north-1.compute.internal>
Date: Sat, 9 May 2026 12:40:50 +0000
Subject: [PATCH] =?UTF-8?q?Fix=20admin=20update=20forms=20=E2=80=94=20rest?=
 =?UTF-8?q?ore=20proper=20value=3D""=20quoting?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The security hardening commit accidentally rendered every input value as
value=\"...\" (literal backslash-quote in HTML), which mangled all
submitted fields including the hidden worker_id/service_id, causing
UPDATE to match zero rows and silently no-op.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../admin/includes/update-service-form.php    | 24 +++++++++----------
 .../admin/includes/update-worker-form.php     | 10 ++++----
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/application/views/admin/includes/update-service-form.php b/application/views/admin/includes/update-service-form.php
index 4f468f8..551e4cf 100755
--- a/application/views/admin/includes/update-service-form.php
+++ b/application/views/admin/includes/update-service-form.php
@@ -1,7 +1,7 @@
 <div class="mainContentContainer" style="top:100px">
     <div class="pageTitle"><?php echo $pageTitle;?></div>
     <form method="post" action="<?php echo base_url();?>services/service-process">
-    <input type="hidden" name ="service_id" value=\"<?php echo htmlspecialchars($selectedItem->service_id, ENT_QUOTES, 'UTF-8');?>\">
+    <input type="hidden" name ="service_id" value="<?php echo htmlspecialchars($selectedItem->service_id, ENT_QUOTES, 'UTF-8');?>">
         <div class="formRow">
             <label class="formTitle">Típus</label>
             <select class="formDropdownBox" style="padding:0;" name="service_type">
@@ -11,47 +11,47 @@
         </div>
         <div class="formRow">
             <label class="formTitle">Kategória (NO)</label>
-            <input type="text" class="formInputBox" name="service_category_no" value=\"<?php echo htmlspecialchars($selectedItem->service_category_no, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_category_no" value="<?php echo htmlspecialchars($selectedItem->service_category_no, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Kategória (EN)</label>
-            <input type="text" class="formInputBox" name="service_category_en" value=\"<?php echo htmlspecialchars($selectedItem->service_category_en, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_category_en" value="<?php echo htmlspecialchars($selectedItem->service_category_en, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Kategória (HU)</label>
-            <input type="text" class="formInputBox" name="service_category_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_category_hu, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_category_hu" value="<?php echo htmlspecialchars($selectedItem->service_category_hu, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Megnevezés (NO)</label>
-            <input type="text" class="formInputBox" name="service_name_no" value=\"<?php echo htmlspecialchars($selectedItem->service_name_no, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_name_no" value="<?php echo htmlspecialchars($selectedItem->service_name_no, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Megnevezés (EN)</label>
-            <input type="text" class="formInputBox" name="service_name_en" value=\"<?php echo htmlspecialchars($selectedItem->service_name_en, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_name_en" value="<?php echo htmlspecialchars($selectedItem->service_name_en, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Megnevezés (HU)</label>
-            <input type="text" class="formInputBox" name="service_name_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_name_hu, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_name_hu" value="<?php echo htmlspecialchars($selectedItem->service_name_hu, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Leírás (NO)</label>
-            <input type="text" class="formInputBox" name="service_description_no" value=\"<?php echo htmlspecialchars($selectedItem->service_description_no, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_description_no" value="<?php echo htmlspecialchars($selectedItem->service_description_no, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Leírás (EN)</label>
-            <input type="text" class="formInputBox" name="service_description_en" value=\"<?php echo htmlspecialchars($selectedItem->service_description_en, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_description_en" value="<?php echo htmlspecialchars($selectedItem->service_description_en, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Leírás (HU)</label>
-            <input type="text" class="formInputBox" name="service_description_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_description_hu, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="service_description_hu" value="<?php echo htmlspecialchars($selectedItem->service_description_hu, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Szolgáltatás ára</label>
-            <input type="number" class="formInputBox" name="service_price" value=\"<?php echo htmlspecialchars($selectedItem->service_price, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="number" class="formInputBox" name="service_price" value="<?php echo htmlspecialchars($selectedItem->service_price, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Szolgáltatás időtartama</label>
-            <input type="time" class="formInputBox" name="service_time" value=\"<?php echo htmlspecialchars($selectedItem->service_time, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="time" class="formInputBox" name="service_time" value="<?php echo htmlspecialchars($selectedItem->service_time, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Szolgáltatás kategória</label>
diff --git a/application/views/admin/includes/update-worker-form.php b/application/views/admin/includes/update-worker-form.php
index 53c93dc..df195fe 100755
--- a/application/views/admin/includes/update-worker-form.php
+++ b/application/views/admin/includes/update-worker-form.php
@@ -1,10 +1,10 @@
 <div class="mainContentContainer" style="top:100px">
     <div class="pageTitle"><?php echo $pageTitle;?></div>
     <form method="post" action="<?php echo base_url();?>workers/worker-process" enctype="multipart/form-data">
-    <input type="hidden" name ="worker_id" value=\"<?php echo htmlspecialchars($selectedItem->worker_id, ENT_QUOTES, 'UTF-8');?>\">
+    <input type="hidden" name ="worker_id" value="<?php echo htmlspecialchars($selectedItem->worker_id, ENT_QUOTES, 'UTF-8');?>">
         <div class="formRow">
             <label class="formTitle">Név</label>
-            <input type="text" class="formInputBox" name="worker_name" value=\"<?php echo htmlspecialchars($selectedItem->worker_name, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="worker_name" value="<?php echo htmlspecialchars($selectedItem->worker_name, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <img src="<?php echo SITEURL.'assets/img/workers/'.$selectedItem->worker_profile_img;?>" width="100px">
@@ -15,7 +15,7 @@
         </div>
         <div class="formRow">
             <label class="formTitle">Leírás</label>
-            <input type="text" class="formInputBox" name="worker_info" value=\"<?php echo htmlspecialchars($selectedItem->worker_info, ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="worker_info" value="<?php echo htmlspecialchars($selectedItem->worker_info, ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">Beauty</label>
@@ -66,11 +66,11 @@
         </div>
         <div class="formRow">
             <label class="formTitle">Google Calendar ID</label>
-            <input type="text" class="formInputBox" name="google_calendar_id" value=\"<?php echo htmlspecialchars(isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '', ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="google_calendar_id" value="<?php echo htmlspecialchars(isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '', ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <label class="formTitle">ntfy Topic</label>
-            <input type="text" class="formInputBox" name="ntfy_topic" value=\"<?php echo htmlspecialchars(isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '', ENT_QUOTES, 'UTF-8');?>\">
+            <input type="text" class="formInputBox" name="ntfy_topic" value="<?php echo htmlspecialchars(isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '', ENT_QUOTES, 'UTF-8');?>">
         </div>
         <div class="formRow">
             <input type="submit" class="submitButton" name="updateWorker" value="Módosítás">