Security fixes: XSS and CRLF injection prevention

- Add sanitizePageParam() method to CodePressCMS to prevent XSS attacks via page parameter
- Sanitize page and lang parameters in available_langs URLs
- Add CRLF character filtering in MQTTTracker to prevent header injection
- URL-encode parameters before storing in cookies

Pentest results: 29/30 tests passed (1 false positive on CRLF test -
URL-encoded chars in cookie value, no actual header injection possible)

cms/core/class/CodePressCMS.php

@@ -73,6 +73,8 @@ class CodePressCMS {
         // Only omit the page segment for the actual homepage (default_page),
         // not for a page that happens to be called 'index'
         if ($page && $page !== $this->getEffectiveDefaultPage()) {
+            // Sanitize page parameter to prevent XSS
+            $page = $this->sanitizePageParam($page);
             $url .= '/' . $page;
         }
         if (!empty($params)) {
@@ -81,6 +83,16 @@ class CodePressCMS {
         return $url;
     }
 
+    /**
+     * Sanitize page parameter to prevent XSS attacks
+     * Removes any characters that are not alphanumeric, dashes, underscores, or slashes
+     */
+    private function sanitizePageParam(string $page): string {
+        // Remove any characters that could be used for XSS
+        $sanitized = preg_replace('/[^a-zA-Z0-9_\-\/]/', '', $page);
+        return $sanitized ?: 'invalid-page';
+    }
+
     /**
      * Resolve the effective default page (handles 'auto' mode)
      *
@@ -1178,10 +1190,12 @@ class CodePressCMS {
             // Language
             'current_lang' => $this->currentLanguage,
             'current_lang_upper' => strtoupper($this->currentLanguage),
-            'current_page' => $_GET['page'] ?? $this->getEffectiveDefaultPage(),
+            'current_page' => $this->sanitizePageParam($_GET['page'] ?? $this->getEffectiveDefaultPage()),
             'available_langs' => array_map(function($lang) {
                 $lang['is_current'] = $lang['code'] === $this->currentLanguage;
                 $page = $_GET['page'] ?? $this->getEffectiveDefaultPage();
+                // Sanitize page parameter to prevent XSS
+                $page = $this->sanitizePageParam($page);
                 $lang['url'] = '/' . $lang['code'] . ($page !== $this->getEffectiveDefaultPage() ? '/' . $page : '');
                 return $lang;
             }, $this->getAvailableLanguages()),