fix(guard): cast drp_action valid-actions to strings for strict in_array

array_keys($actions + $assoc_actions) returns integer keys; POST values
are always strings. Without the strval() cast, in_array(..., true) with
strict comparison always fails, making every bulk form action unreachable.

Adds regression test asserting the strval() cast is present.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Author: somethingwithproof

notify_lists.php

@@ -148,7 +148,7 @@ function form_actions() {
 	// ================= input validation =================
 	get_filter_request_var('drp_action');
 
-	$valid_actions = array_keys($actions + $assoc_actions);
+	$valid_actions = array_map('strval', array_keys($actions + $assoc_actions));
 
 	if (!in_array(get_request_var('drp_action'), $valid_actions, true)) {
 		raise_message(40);

tests/Security/PreparedStatementTest.php

@@ -64,3 +64,9 @@
 it('thold_functions.php get_allowed_threshold_logs uses db_fetch_assoc_prepared', function () use ($funcs_src) {
 	expect($funcs_src)->toContain('db_fetch_assoc_prepared("SELECT');
 });
+
+it('notify_lists.php drp_action guard converts keys to strings before strict comparison', function () use ($notify_src) {
+	// array_keys() returns int keys; POST values are strings; strval() cast allows strict in_array()
+	expect($notify_src)->toContain("array_map('strval', array_keys(\$actions + \$assoc_actions))");
+	expect($notify_src)->toContain("in_array(get_request_var('drp_action'), \$valid_actions, true)");
+});