Fix #12972

app/Http/Controllers/Json/ReconcileController.php

@@ -32,11 +32,13 @@ use FireflyIII\Http\Controllers\Controller;
 use FireflyIII\Models\Account;
 use FireflyIII\Models\TransactionCurrency;
 use FireflyIII\Repositories\Account\AccountRepositoryInterface;
+use FireflyIII\Rules\System\IsValidOriginUrl;
 use FireflyIII\Support\Facades\Steam;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\View as ViewFacade;
 use Throwable;
 
 /**
@@ -169,7 +171,7 @@ final class ReconcileController extends Controller
      *
      * @throws FireflyException
      */
-    public function transactions(Account $account, ?Carbon $start = null, ?Carbon $end = null)
+    public function transactions(Request $request, Account $account, ?Carbon $start = null, ?Carbon $end = null)
     {
         if (!$start instanceof Carbon || !$end instanceof Carbon) {
             throw new FireflyException('Invalid dates submitted.');
@@ -182,6 +184,14 @@ final class ReconcileController extends Controller
         $startDate      = clone $start;
         $startDate->subDay();
 
+        // validate from or exit
+        $from       = $request->input('_from');
+        $validator = validator(['_from' => $from], ['nullable', 'max:255', new IsValidOriginUrl()]);
+        if ($validator->fails()) {
+            throw new FireflyException(trans('validation.bad_url_parts'));
+        }
+        ViewFacade::share('FF3_FROM', $from);
+
         $currency       = $this->accountRepos->getAccountCurrency($account) ?? $this->primaryCurrency;
         // correct
         Log::debug(sprintf('transactions: Call accountsBalancesOptimized with date/time "%s"', $startDate->toIso8601String()));

app/Http/Controllers/SearchController.php

@@ -25,6 +25,7 @@ namespace FireflyIII\Http\Controllers;
 
 use FireflyIII\Exceptions\FireflyException;
 use FireflyIII\Repositories\Rule\RuleRepositoryInterface;
+use FireflyIII\Rules\System\IsValidOriginUrl;
 use FireflyIII\Support\Search\SearchInterface;
 use Illuminate\Contracts\View\Factory;
 use Illuminate\Http\JsonResponse;
@@ -56,11 +57,6 @@ final class SearchController extends Controller
         });
     }
 
-    /**
-     * Do the search.
-     *
-     * @return Factory|View
-     */
     public function index(Request $request, SearchInterface $searcher): Factory|\Illuminate\Contracts\View\View
     {
         // search params:
@@ -126,7 +122,13 @@ final class SearchController extends Controller
         $fullQuery  = (string) $entry;
         $page       = 0 === (int) $request->input('page') ? 1 : (int) $request->input('page');
         $page       = clamp(value: $page, min: 1, max: 2 ** 16);
+
+        // validate from or exit
         $from       = $request->input('_from');
+        $validator = validator(['_from' => $from], ['nullable', 'max:255', new IsValidOriginUrl()]);
+        if ($validator->fails()) {
+            throw new FireflyException(trans('validation.bad_url_parts'));
+        }
 
         $searcher->parseQuery($fullQuery);
 

changelog.md

@@ -11,6 +11,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 - Self-hosted users should no longer run into `Target class [has] does not exist` errors.
 - Explain in the release notes how to clear your cache, as suggested by @Kage1
+- #12972
 - #13022
 
 ## v6.7.8 - 2026-10-10

resources/views/accounts/reconcile/index.blade.php

@@ -124,7 +124,7 @@
         var accountID = {{ $account->id }};
         var startBalance = {{ $startBalance }};
         var endBalance = {{ $endBalance }};
-        var transactionsUrl = '{{ $transactionsUrl }}';
+        var transactionsUrl = '{{ $transactionsUrl }}?_from={{ urlencode($FF3_FROM) }}';
         var overviewUrl = '{{ $overviewUrl }}';
         var indexUrl = '{{ $indexUrl }}';
         var selectRangeAndBalance = '{{ __('firefly.select_range_and_balance') }}';

resources/views/accounts/reconcile/transactions.blade.php

@@ -31,9 +31,6 @@
                         {{ trans('firefly.start_of_reconcile_period', ['period' => $start->isoFormat($monthAndDayFormat)]) }}
                     </span>
                 </td>
-                <td colspan="2">
-                    &nbsp;
-                </td>
             </tr>
             @php
             $startSet = true;
@@ -54,9 +51,6 @@
                         {{ trans('firefly.end_of_reconcile_period', ['period' => $end->isoFormat($monthAndDayFormat)]) }}
                     </span>
                 </td>
-                <td colspan="2">
-                    &nbsp;
-                </td>
             </tr>
             @php
                 $endSet = true;

resources/views/search/index.blade.php

@@ -137,7 +137,7 @@
         var searchQuery = "{!! escape_for_js($fullQuery) !!}";
         var searchUrl = "{{ route('search.search') }}?page={{ $page }}";
         var searchPage = {{ $page }};
-        var from = '{{ $FF3_FROM }}';
+        var from = '{{ $FF3_FROM }}'; {{-- is used to correct the _from url in the search results. --}}
         var cloneGroupUrl = '{{ route('transactions.clone') }}';
         var cloneAndEditUrl = '{{ route('transactions.clone') }}?redirect=edit';
     </script>