* LightSmsTransport.php - escape phone number

Vasilij Dusko | CREATION · Vasilij Dusko | CREATION · commit 5d2e6928f33c · 2021-03-29T13:29:53.000+03:00
diff --git a/src/Symfony/Component/Notifier/Bridge/LightSms/LightSmsTransport.php b/src/Symfony/Component/Notifier/Bridge/LightSms/LightSmsTransport.php
@@ -109,8 +109,8 @@ protected function doSend(MessageInterface $message): SentMessage
             $this->getEndpoint(),
             $this->login,
             $signature,
-            str_replace('+', '', $message->getPhone()),
-            $message->getSubject(),
+            $this->escapePhoneNumber($message->getPhone()),
+            $this->escapeSubject($message->getSubject()),
             $this->phone,
             time()
         );
@@ -141,14 +141,24 @@ private function generateSignature(array $params): string
         $params = [
             'timestamp' => $params['timestamp'],
             'login' => $this->login,
-            'phone' => str_replace('+', '', $params['message']->getPhone()),
+            'phone' => $this->escapePhoneNumber($params['message']->getPhone()),
             'sender' => $this->phone,
-            'text' => $params['message']->getSubject(),
+            'text' => $this->escapeSubject($params['message']->getSubject()),
         ];
 
         ksort($params);
         reset($params);
 
         return md5(implode('', $params).$this->password);
     }
+
+    private function escapeSubject($subject): string
+    {
+        return strip_tags($subject);
+    }
+
+    private function escapePhoneNumber($phoneNumber): string
+    {
+        return str_replace('+', '', $phoneNumber);
+    }
 }
