[pull] 2.x from Kovah:2.x

app/Http/Requests/SetupDatabaseRequest.php

@@ -18,19 +18,23 @@ public function rules(): array
             ],
             'db_host' => [
                 'required_unless:connection,sqlite',
+                'not_regex:/[\r\n]/',
             ],
             'db_port' => [
                 'required_unless:connection,sqlite',
                 'numeric',
             ],
             'db_name' => [
                 'required_unless:connection,sqlite',
+                'not_regex:/[\r\n]/',
             ],
             'db_user' => [
                 'required_unless:connection,sqlite',
+                'not_regex:/[\r\n]/',
             ],
             'db_password' => [
                 'nullable',
+                'not_regex:/[\r\n]/',
             ],
         ];
     }

tests/Controller/SetupDatabaseControllerTest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Tests\Controller;
+
+use App\Settings\SystemSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class SetupDatabaseControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_database_setup_rejects_multiline_passwords(): void
+    {
+        SystemSettings::fake([
+            'setup_completed' => false,
+        ]);
+
+        $response = $this->from('/setup/database')->post('/setup/database', [
+            'connection' => 'mysql',
+            'db_host' => '127.0.0.1',
+            'db_port' => 3306,
+            'db_name' => 'linkace',
+            'db_user' => 'linkace',
+            'db_password' => "secret\nMAIL_MAILER=sendmail",
+        ]);
+
+        $response
+            ->assertRedirect('/setup/database')
+            ->assertSessionHasErrors('db_password');
+    }
+}