* fix(functions): compare string offsets explicitly in sanitize_uri
A graph_view.php URI opening with 'action=' or '?' matched at offset 0, which
strpos() reports as a falsy 0, so it gained a duplicate token.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(functions): fall back when preg_replace returns null
clean_up_lines() and sanitize_uri() were the two sites without the guard every
sibling call in the file already had.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(changelog): note the sanitiser repairs
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(functions): tighten sanitizer contracts
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
