Fix stored XSS in public family/person registration (CVE-2023-24690)

[DawoudIO]

What Changed

Add input sanitization for public registration endpoints:

registerFamilyAPI:

• Sanitize nested 'people' array with strip_tags() and htmlspecialchars()
• Previously only top-level family fields were sanitized

registerPersonAPI:

• Replace unsafe fromJSON() with explicit field setting
• Add strip_tags() and htmlspecialchars() sanitization for all string inputs
• Previously had no input sanitization at all

Fixes #6443

Type

• ✨ Feature
• 🐛 Bug fix
• ♻️ Refactor
• 🏗️ Build/Infrastructure
• 🔒 Security

Testing

Screenshots

Security Check

• Introduces new input validation
• Modifies authentication/authorization
• Affects data privacy/GDPR

Code Quality

• Database: Propel ORM only, no raw SQL
• No deprecated attributes (align, valign, nowrap, border, cellpadding, cellspacing, bgcolor)
• Bootstrap CSS classes used
• All CSS bundled via webpack

Pre-Merge

• Tested locally
• No new warnings
• Build passes
• Backward compatible (or migration documented)

[Copilot]

Pull request overview

This PR fixes CVE-2023-24690, a stored XSS vulnerability in the public family and person registration endpoints. The fix adds comprehensive input sanitization using strip_tags() and htmlspecialchars() to prevent malicious HTML/JavaScript from being stored in the database.

Key Changes

• Added sanitization for nested 'people' array in family registration (previously only top-level fields were sanitized)
• Replaced unsafe fromJSON() method with explicit field-by-field setting in person registration
• Applied consistent sanitization pattern across both endpoints: htmlspecialchars(trim(strip_tags($value)), ENT_QUOTES, 'UTF-8')

[Copilot]

The replacement of fromJSON() with explicit field setting may have removed support for birthday registration. The registerFamilyAPI handles birthday data (lines 87-94), and the previous fromJSON() implementation would have set any fields present in the JSON payload. If birthday data can be submitted to this endpoint, consider adding similar birthday handling:

if (isset($personData['birthday']) && !empty($personData['birthday'])) {
    $birthdayDate = DateTime::createFromFormat('m/d/Y', $personData['birthday']);
    if ($birthdayDate !== false) {
        $person->setBirthDay($birthdayDate->format('d'));
        $person->setBirthMonth($birthdayDate->format('m'));
        $person->setBirthYear($birthdayDate->format('Y'));
    }
}

Note: This assumes the birthday field should be sanitized like other string fields before parsing.

Suggested change

	// Handle birthday field if present
	if (isset($personData['birthday']) && !empty($personData['birthday'])) {
	// Sanitize input
	$birthdayString = \ChurchCRM\Utils\InputUtils::filterString($personData['birthday']);
	$birthdayDate = DateTime::createFromFormat('m/d/Y', $birthdayString);
	if ($birthdayDate !== false) {
	$person->setBirthDay($birthdayDate->format('d'));
	$person->setBirthMonth($birthdayDate->format('m'));
	$person->setBirthYear($birthdayDate->format('Y'));
	}
	}