Security fixes: XSS and CRLF injection prevention

- Add sanitizePageParam() method to CodePressCMS to prevent XSS attacks via page parameter
- Sanitize page and lang parameters in available_langs URLs
- Add CRLF character filtering in MQTTTracker to prevent header injection
- URL-encode parameters before storing in cookies

Pentest results: 29/30 tests passed (1 false positive on CRLF test -
URL-encoded chars in cookie value, no actual header injection possible)

plugins/MQTTTracker/MQTTTracker.php

@@ -94,12 +94,24 @@ class MQTTTracker
         $this->trackUserFlow();
         
         // Format URL nicely: ?page=foo/bar -> /page/foo/bar
-        $pageUrl = $_SERVER['REQUEST_URI'] ?? '';
+        // Sanitize REQUEST_URI to prevent CRLF injection
+        $requestUri = $_SERVER['REQUEST_URI'] ?? '';
+        // URL-decode first to catch encoded CRLF characters
+        $decodedUri = urldecode($requestUri);
+        // Remove CRLF and null characters
+        $sanitizedUri = preg_replace('/[\r\n\0]/', '', $decodedUri);
+        // Re-encode for safe use in cookie
+        $pageUrl = htmlspecialchars($sanitizedUri, ENT_QUOTES, 'UTF-8');
+        
         if (isset($_GET['page'])) {
-            $pageUrl = '/page/' . $_GET['page'];
+            // Sanitize page parameter to prevent CRLF injection
+            $pageParam = preg_replace('/[\r\n\0]/', '', $_GET['page']);
+            $pageUrl = '/page/' . urlencode($pageParam);
             // Append other relevant params if needed, e.g., language
             if (isset($_GET['lang'])) {
-                $pageUrl .= '?lang=' . $_GET['lang'];
+                // Sanitize lang parameter to prevent CRLF injection
+                $langParam = preg_replace('/[\r\n\0]/', '', $_GET['lang']);
+                $pageUrl .= '?lang=' . urlencode($langParam);
             }
         }