Fixed issue [security] #16068: Stored Cross Site Scripting Vulnerabil…

…ity in permission rules. (Thanks to Matthew Aberegg)
LimeSurvey · Apr 2, 2020 · 2aada33 · 2aada33
1 parent a63c6f5
commit 2aada33
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/application/controllers/admin/PermissiontemplatesController.php b/application/controllers/admin/PermissiontemplatesController.php
@@ -83,6 +83,10 @@ public function applyedit()
         $aPermissiontemplate = Yii::app()->request->getPost('Permissiontemplates');
         $model = $this->loadModel($aPermissiontemplate['ptid']);
 
+        // XSS filter
+        $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);
+        $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);
+
         $newAttributes = array_merge($model->attributes, $aPermissiontemplate);
         $model->attributes = $newAttributes;