From 01a8b77d0f511858b32fb2fa55e5fbc0612ce7b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tomasz=20Chili=C5=84ski?= Date: Sun, 17 Jan 2021 13:28:12 +0100 Subject: [PATCH] bugfix: avoid XSS in ticket and event forms (LMS #1910) --- lib/LMSManagers/LMSEventManager.php | 4 ++-- lib/LMSManagers/LMSHelpdeskManager.php | 9 ++++++-- templates/default/event/eventinfo.html | 20 +++++++++--------- templates/default/event/eventinfoshort.html | 22 ++++++++++---------- templates/default/event/eventlistboxrow.html | 10 ++++----- 5 files changed, 35 insertions(+), 30 deletions(-) diff --git a/lib/LMSManagers/LMSEventManager.php b/lib/LMSManagers/LMSEventManager.php index a7a72416eb..2d320a93ab 100644 --- a/lib/LMSManagers/LMSEventManager.php +++ b/lib/LMSManagers/LMSEventManager.php @@ -34,7 +34,7 @@ public function EventAdd($event) { $args = array( 'title' => $event['title'], - 'description' => $event['description'], + 'description' => Utils::removeInsecureHtml($event['description']), 'date' => $event['date'], 'begintime' => $event['begintime'], 'enddate' => $event['enddate'], @@ -89,7 +89,7 @@ public function EventUpdate($event) { $args = array( 'title' => $event['title'], - 'description' => $event['description'], + 'description' => Utils::removeInsecureHtml($event['description']), 'date' => $event['date'], 'begintime' => $event['begintime'], 'enddate' => $event['enddate'], diff --git a/lib/LMSManagers/LMSHelpdeskManager.php b/lib/LMSManagers/LMSHelpdeskManager.php index 4435082648..4cefeb5dd2 100644 --- a/lib/LMSManagers/LMSHelpdeskManager.php +++ b/lib/LMSManagers/LMSHelpdeskManager.php @@ -1019,6 +1019,11 @@ public function TicketMessageAdd($message, $files = null) $createtime = isset($message['createtime']) ? $message['createtime'] : time(); + $body = preg_replace("/\r/", "", $message['body']); + if ($message['contenttype'] == 'text/html') { + $body = Utils::removeInsecureHtml($body); + } + $this->db->Execute( 'INSERT INTO rtmessages (ticketid, createtime, subject, body, userid, customerid, mailfrom, inreplyto, messageid, replyto, headers, type, phonefrom, contenttype) @@ -1027,7 +1032,7 @@ public function TicketMessageAdd($message, $files = null) $message['ticketid'], $createtime, isset($message['subject']) ? $message['subject'] : '', - preg_replace("/\r/", "", $message['body']), + $body, isset($message['userid']) ? $message['userid'] : Auth::GetCurrentUser(), empty($message['customerid']) ? null : $message['customerid'], isset($message['mailfrom']) ? $message['mailfrom'] : '', @@ -1102,7 +1107,7 @@ public function TicketAdd($ticket, $files = null) if ($ticket['contenttype'] == 'text/plain') { $body = str_replace("\r", "", $ticket['body']); } else { - $body = $ticket['body']; + $body = Utils::removeInsecureHtml($ticket['body']); } $this->db->Execute('INSERT INTO rtmessages (ticketid, customerid, createtime, diff --git a/templates/default/event/eventinfo.html b/templates/default/event/eventinfo.html index d9a63d11b4..b174aea373 100644 --- a/templates/default/event/eventinfo.html +++ b/templates/default/event/eventinfo.html @@ -19,7 +19,7 @@

{$layout.pagetitle}

{trans("Title:")} - {$event.title} + {$event.title|escape} @@ -129,7 +129,7 @@

{$layout.pagetitle}

{trans("Last modified by:")} - {$event.modusername} + {$event.modusername|escape} {/if} @@ -155,7 +155,7 @@

{$layout.pagetitle}

{trans("Closed by")}: - {$event.closedusername} + {$event.closedusername|escape} {/if} @@ -192,18 +192,18 @@

{$layout.pagetitle}

{if $event.netnode_name} - {icon name="netnode"} {$event.netnode_name} + {icon name="netnode"} {$event.netnode_name|escape} {if !empty($event.netnode_location)} -
{icon name="location"} {$event.netnode_location}{/if} +
{icon name="location"} {$event.netnode_location|escape}{/if} {else} {if $event.customername} {icon name="customer"} {$event.customername|truncate:"30":"...":true}
{if !empty($event.address_id)} - {icon name="location"} {$event.location} + {icon name="location"} {$event.location|escape} {elseif !empty($event.nodeid)} - {$event.nodelocation} + {$event.nodelocation|escape} {else} - {icon name="location"} {$event.customerlocation} + {icon name="location"} {$event.customerlocation|escape} {/if} {/if} {/if} @@ -218,7 +218,7 @@

{$layout.pagetitle}

{trans("Node:")} - {$event.node_name}: {$event.node_location} + {$event.node_name}: {$event.node_location|escape} {/if} @@ -234,7 +234,7 @@

{$layout.pagetitle}

- {$event.note|replace:"\n":"
"} + {$event.note|escape|replace:"\n":"
"}
diff --git a/templates/default/event/eventinfoshort.html b/templates/default/event/eventinfoshort.html index 18da7a3c97..22d4731319 100644 --- a/templates/default/event/eventinfoshort.html +++ b/templates/default/event/eventinfoshort.html @@ -24,7 +24,7 @@ {trans("Title:")} - {$event.title} + {$event.title|escape} @@ -130,7 +130,7 @@ {trans("Last modified by:")} - {$event.modusername} + {$event.modusername|escape} {/if} @@ -156,7 +156,7 @@ {trans("Closed by")}: - {$event.closedusername} + {$event.closedusername|escape} {/if} @@ -182,7 +182,7 @@ {trans("Customer:")} - {$event.customername} + {$event.customername|escape} {/if} @@ -196,16 +196,16 @@ {if $event.netnode_name} - {icon name="netnode" class="fa-fw"}{$event.netnode_name} - {if !empty($event.netnode_location)}
{$event.netnode_location}{/if} + {icon name="netnode" class="fa-fw"}{$event.netnode_name|escape} + {if !empty($event.netnode_location)}
{$event.netnode_location|escape}{/if} {else} {if $event.customername} {if !empty($event.address_id)} - {$event.location} + {$event.location|escape} {elseif !empty($event.nodeid)} - {$event.nodelocation} + {$event.nodelocation|escape} {else} - {$event.customerlocation} + {$event.customerlocation|escape} {/if} {/if} {/if} @@ -221,7 +221,7 @@ {trans("Node:")} - {$event.node_name}: {$event.node_location} + {$event.node_name}: {$event.node_location|escape} {/if} @@ -235,7 +235,7 @@
- {$event.note|replace:"\n":"
"} + {$event.note|escape|replace:"\n":"
"}
diff --git a/templates/default/event/eventlistboxrow.html b/templates/default/event/eventlistboxrow.html index 26808c3d83..5c5b8f35d0 100644 --- a/templates/default/event/eventlistboxrow.html +++ b/templates/default/event/eventlistboxrow.html @@ -38,9 +38,9 @@ {/if} - {$event.title} + {$event.title|escape} {if !ConfigHelper::checkConfig('phpui.timetable_hide_description')}{if $event.description != ''}
{icon name="description"} {$event.description}{/if}{/if} - {if $event.note != ''}
{icon name="note"} {$event.note}{/if} + {if $event.note != ''}
{icon name="note"} {$event.note|escape}{/if} {if $event.netnode_name} @@ -50,11 +50,11 @@ {if $event.customername} {icon name="customer"} {$event.customername|truncate:"30":"...":true}
{if !empty($event.address_id)} - {icon name="location"} {$event.location} + {icon name="location"} {$event.location|escape} {elseif !empty($event.nodeid)} - {$event.nodelocation} + {$event.nodelocation|escape} {else} - {icon name="location"} {$event.customerlocation} + {icon name="location"} {$event.customerlocation|escape} {/if} {/if} {/if}