From a728a8a556451bda8ca814e5aaf2d95956fc8963 Mon Sep 17 00:00:00 2001
From: NOrtmann1 <ortmann.niklas@yahoo.de>
Date: Sun, 19 Jul 2026 16:08:55 +0200
Subject: [PATCH] Update showArticle-controller.php

---
 php/controller/showArticle-controller.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/php/controller/showArticle-controller.php b/php/controller/showArticle-controller.php
index dff5eae..89d99c4 100644
--- a/php/controller/showArticle-controller.php
+++ b/php/controller/showArticle-controller.php
@@ -7,10 +7,14 @@ require_once 'php/model/Article.php';
 require_once 'php/model/ArticleManager.php';
 require_once 'php/model/UserManager.php';
 require_once 'php/model/CommentManager.php';
+require_once 'php/validator/article-validator.php';
 
-if (isset($_GET["id"]) && !empty($_GET["id"])){
+// Die übergebene ID muss eine gültige, positive Zahl sein, bevor sie
+// weiterverwendet wird. Vorher wurde jeder nicht-leere Wert akzeptiert.
+$id = isset($_GET["id"]) ? articleIdValidator($_GET["id"]) : false;
+
+if ($id !== false) {
     try {
-        $id = $_GET["id"];
         $articleManager = ArticleManager::getInstance();
         $article = $articleManager->getArticle($id);
         if($article != null){
@@ -38,7 +42,7 @@ if (isset($_GET["id"]) && !empty($_GET["id"])){
         }
 
         $commentManager = CommentManager::getInstance();
-        $comments = $commentManager->getCommentsByArticle($_GET["id"]);
+        $comments = $commentManager->getCommentsByArticle($id); // NEU: validierte ID statt rohem $_GET["id"]
 
         foreach ($comments as $comment) {
             if ($comment->isReply()) {