From b0a814296300be7cd0847bd012e106db56ca4e73 Mon Sep 17 00:00:00 2001
From: Antoine Lemarchand <antoine.lemarchand@itsm-ng.com>
Date: Thu, 30 May 2024 10:07:00 +0200
Subject: [PATCH 1/2] fix(commondbtm.class.php): template auto name fix Fixing
 #286

---
 inc/commondbtm.class.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/inc/commondbtm.class.php b/inc/commondbtm.class.php
index ae5239c830..ce75e1cd02 100644
--- a/inc/commondbtm.class.php
+++ b/inc/commondbtm.class.php
@@ -1490,9 +1490,13 @@ function prepareInputForClone($input) {
          }
 
          // Try to find an available name
-         do {
-            $copy_name = $this->computeCloneName($current_name, ++$copy_index);
-         } while (countElementsInTable($table, [$name_field => $copy_name]) > 0);
+         if (!$input['is_template'] || countElementsInTable($table, [$name_field => $current_name]) > 0) {
+             do {
+                $copy_name = $this->computeCloneName($current_name, ++$copy_index);
+             } while (countElementsInTable($table, [$name_field => $copy_name]) > 0);
+         } else {
+            $copy_name = $current_name;
+         }
 
          // Update index cache
          $this->last_clone_index = $copy_index;

From bc23f834e3edba7c58475c8ceb031f7dd505b76d Mon Sep 17 00:00:00 2001
From: Antoine Lemarchand <antoine.lemarchand@itsm-ng.com>
Date: Wed, 5 Jun 2024 11:25:37 +0200
Subject: [PATCH 2/2] fix: CVE GHSA-gcj4-2cp3-6h5j

---
 inc/search.class.php | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/inc/search.class.php b/inc/search.class.php
index 603fdfb5af..c2e5b233a9 100644
--- a/inc/search.class.php
+++ b/inc/search.class.php
@@ -396,6 +396,8 @@ static function prepareDatasForSearch($itemtype, array $params, array $forcedisp
          $p['start'] = 0;
       }
 
+      $p = self::cleanParams($p);
+
       $data             = [];
       $data['search']   = $p;
       $data['itemtype'] = $itemtype;
@@ -6755,9 +6757,29 @@ static function manageParams($itemtype, $params = [], $usesession = true,
          }
       }
 
-      return $params;
+      return self::cleanParams($params);
    }
 
+    public static function cleanParams(array $params): array
+    {
+        $int_params = [
+            'sort'
+        ];
+
+        foreach ($params as $key => &$val) {
+            if (in_array($key, $int_params)) {
+                if (is_array($val)) {
+                    foreach ($val as &$subval) {
+                        $subval = (int)$subval;
+                    }
+                } else {
+                    $val = (int)$val;
+                }
+            }
+        }
+
+        return $params;
+    }
 
    /**
     * Clean search options depending of user active profile