From 7496ec701ca9cb3e17722fe021c8ea75327615ae Mon Sep 17 00:00:00 2001
From: minimexat <minimexat@gmail.com>
Date: Sun, 8 Feb 2026 14:46:02 +0100
Subject: [PATCH] FIX #36923 Fix undefined array key warnings in opensurvey
 create_survey.php (#37140)

The session variable initialization logic was inverted: it set variables
to null only when they already existed, instead of initializing them
when they were missing. This caused 'undefined array key' warnings on
PHP 8.1+ when accessing the poll creation form for the first time.

Changes:
- Inverted isset() condition to !isset() to properly initialize missing
  session variables
- Initialize to empty string instead of null
- Added missing session variables (allow_comments, allow_spy, champdatefin)
  to the initialization array
- Added dol_escape_htmltag() for title output (XSS hardening)

Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
---
 htdocs/opensurvey/wizard/create_survey.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/htdocs/opensurvey/wizard/create_survey.php b/htdocs/opensurvey/wizard/create_survey.php
index 4b28dc2b70e..8c997b78dd4 100644
--- a/htdocs/opensurvey/wizard/create_survey.php
+++ b/htdocs/opensurvey/wizard/create_survey.php
@@ -53,8 +53,8 @@ $mailsonde = GETPOST('mailsonde');
 $creation_sondage_date = GETPOST('creation_sondage_date');
 $creation_sondage_autre = GETPOST('creation_sondage_autre');
 
-// We init some session variable to avoid warning
-$session_var = array('title', 'description', 'mailsonde', 'allow_comments', 'allow_spy');
+// We init some session variables to avoid PHP 8 "undefined array key" warning
+$session_var = array('title', 'description', 'mailsonde', 'allow_comments', 'allow_spy', 'champdatefin');
 foreach ($session_var as $var) {
 	if (!isset($_SESSION[$var])) {
 		$_SESSION[$var] = '';
@@ -151,7 +151,7 @@ print '<table class="border centpercent">'."\n";
 
 print '<tr><td class="titlefieldcreate fieldrequired">'.$langs->trans("PollTitle").'</td>';
 
-print '<td><input type="text" name="title" class="minwidth300" maxlength="80" value="'.$_SESSION["title"].'" autofocus></td>'."\n";
+print '<td><input type="text" name="title" class="minwidth300" maxlength="80" value="'.dol_escape_htmltag($_SESSION["title"]).'" autofocus></td>'."\n";
 if (!$_SESSION["title"] && (GETPOST('creation_sondage_date') || GETPOST('creation_sondage_autre'))) {
 	setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("PollTitle")), null, 'errors');
 }