CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary

The custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

## Details

### Root cause: by-reference mutation never propagates

`Modules\Backend\Validation\CustomRules::html_purify` declares its first argument by reference:

```php // modules/Backend/Validation/CustomRules.php:54-73 public function html_purify(?string &$str = null, ?string &$error = null): bool { if (empty(trim((string)$str))) return true; if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; } $clean = self::sanitizeHtml($str); $str = $clean; // <-- mutates only the local $value in CI4's validator self::$cleanCache[md5((string)$str)] = $clean; // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL) return true; } ```

CI4's validator invokes the rule via a local variable `$value` it created from a copy of `$this->data`:

```php // vendor/codeigniter4/framework/system/Validation/Validation.php:204-211 foreach ($values as $dotField => $value) {…