From 27cae863ac6d7d251379679d9299be5942c67c33 Mon Sep 17 00:00:00 2001
From: Terranom674 <thomas_dannenberg@web.de>
Date: Sat, 15 Aug 2026 14:40:17 +0200
Subject: [PATCH] Validate global watermark profile settings

---
 tools/watermark_settings.inc.php | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/tools/watermark_settings.inc.php b/tools/watermark_settings.inc.php
index ef970a8..5899443 100644
--- a/tools/watermark_settings.inc.php
+++ b/tools/watermark_settings.inc.php
@@ -15,14 +15,30 @@ function bratonien_tools_get_watermark_defaults()
   ), is_array($defaults) ? $defaults : array());
 }
 
+function bratonien_tools_validate_default_profile($value)
+{
+  if ($value === '' || $value === null)
+  {
+    return null;
+  }
+
+  $id = (int)$value;
+  if ($id <= 0 || !bratonien_tools_get_watermark_profile($id))
+  {
+    throw new RuntimeException('Ungueltiges Wasserzeichenprofil in den globalen Regeln.');
+  }
+
+  return $id;
+}
+
 function bratonien_tools_save_watermark_defaults()
 {
   $config = array(
-    'public_profile' => !empty($_POST['public_profile']) ? (int)$_POST['public_profile'] : null,
-    'private_profile' => !empty($_POST['private_profile']) ? (int)$_POST['private_profile'] : null,
+    'public_profile' => bratonien_tools_validate_default_profile($_POST['public_profile'] ?? null),
+    'private_profile' => bratonien_tools_validate_default_profile($_POST['private_profile'] ?? null),
   );
 
   conf_update_param('bratonien_watermark_defaults', json_encode($config));
 
-  return array('message'=>'Globale Wasserzeichenprofile gespeichert.');
+  return array('message'=>'Globale Wasserzeichenregeln gespeichert.');
 }