Validate statistics visitor source

[giuscris]

This pull request refactors how visitor source detection is handled and improves the accuracy and security of source tracking in statistics. The main changes include introducing a new Visitor::getSource() method for determining the source of a visit, updating statistics tracking to use this method, and enhancing output escaping for source display in the statistics panel.

Visitor source detection and tracking:

• Added a new static method Visitor::getSource(Request $request) in Visitor.php to centralize and improve logic for determining the visitor's source, returning an empty string for direct visits, null for invalid or same-host sources, and the source host otherwise.
• Updated Statistics::trackVisit() to use Visitor::getSource() for source tracking, ensuring consistent and accurate detection of external referrers.

Security and display improvements:

• Escaped the $source value in the statistics panel (statistics/index.php) before outputting, preventing potential XSS vulnerabilities and ensuring safe display of source names.

Dependency updates:

• Added use Formwork\Utils\Uri to Visitor.php to support host extraction from referer URLs.

[Copilot]

Pull request overview

This pull request centralizes visitor source detection into Visitor::getSource() and updates statistics tracking and panel rendering to use the new source logic, with additional output escaping to improve safety of source display.

Changes:

• Added Visitor::getSource(Request $request): ?string to compute and validate the visit source host.
• Updated Statistics::trackVisit() to use Visitor::getSource() for source tracking.
• Escaped the source value in the statistics panel sources table output.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
panel/views/statistics/index.php	Escapes source values before rendering them in the statistics UI.
formwork/src/Statistics/Statistics.php	Switches source tracking to the new centralized visitor-source method.
formwork/src/Http/Utils/Visitor.php	Introduces getSource() to extract/validate a referrer host as the visit source.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

formwork/src/Http/Utils/Visitor.php:99

• Same as above for the request host: requiring FILTER_VALIDATE_DOMAIN means any IP-based Host header will make the method return null, dropping all non-direct sources. If the goal is to validate hosts, consider allowing IPs here too so source-vs-host comparisons still work for IP-hosted instances.

        if (
            $host === null || filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false
            || $source === $host // Source and host are lowercased by `Uri::host()`
        ) {
            return null;

formwork/src/Http/Utils/Visitor.php:80

• getSource() currently rejects IP-address sources (and will also refuse to compare against an IP Host header), because it only allows FILTER_VALIDATE_DOMAIN. This can cause referrer sources to be dropped entirely when the site is accessed via an IP (common in staging/internal deployments), even though the referer host parsing succeeded.

This issue also appears on line 95 of the same file.

        if ($source === null || filter_var($source, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false) {
            return null;
        }