Fixed issue [security] #16396: Multiple self-stored XSS in printanswer

Dev: Add answercode for testing if other (-oth-) Dev: fix other : single choice and multiple choice Dev: div fix comments on multiple with comments Dev: list with comment not fixed (comment are not shown …)
LimeSurvey · Jun 18, 2020 · afcb657 · afcb657
1 parent 98cd4f3
commit afcb657
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 5 deletions.
diff --git a/application/models/SurveyDynamic.php b/application/models/SurveyDynamic.php
@@ -864,6 +864,7 @@ public function getQuestionArray($oQuestion, $oResponses, $bHonorConditions, $su
             $aQuestionAttributes['dateformat'] = getDateFormatDataForQID($aQuestionAttributes, array_merge(self::$survey->attributes, $oQuestion->survey->languagesettings[$oQuestion->language]->attributes));
         }
         $aQuestionAttributes['answervalue'] = isset($oResponses[$fieldname]) ? $oResponses[$fieldname] : null;
+        $aQuestionAttributes['answercode'] = $aQuestionAttributes['answervalue']; // Must keep original code for -oth- and maybe other 
         if ((in_array($oQuestion->type, ["!", "L", "O", "F", "H"]))
             || ($oQuestion->type=='T' && $oQuestion->parent_qid != 0) ) {
 

diff --git a/themes/survey/vanilla/views/subviews/printanswers/question_types/template_list-dropdown.twig b/themes/survey/vanilla/views/subviews/printanswers/question_types/template_list-dropdown.twig
@@ -5,7 +5,12 @@
         <div class="col-md-4 text-right">
         </div>
         <div class="col-md-8 text-left">
-            {{question.answervalue}} - {{question.answeroption.answer}}
+            {{question.answervalue}} -
+            {% if question.answercode == '-oth-' %}
+                {{question.answeroption.answer|escape}}
+            {% else %}
+                {{question.answeroption.answer}}
+            {%endif %}
         </div>
     </div>
 </div>

diff --git a/themes/survey/vanilla/views/subviews/printanswers/question_types/template_list-radio.twig b/themes/survey/vanilla/views/subviews/printanswers/question_types/template_list-radio.twig
@@ -3,7 +3,11 @@
  <div class="col-md-8">
     <div class="row">
         <div class="col-md-4 text-right">
-            {{question.answeroption.answer}}
+            {% if question.answercode == '-oth-' %}
+                {{question.answeroption.answer|escape}}
+            {% else %}
+                {{question.answeroption.answer}}
+            {%endif %}
         </div>
         <div class="col-md-8 text-left">
             <b>{{question.answervalue}}</b>

diff --git a/...ey/vanilla/views/subviews/printanswers/question_types/template_multiple-opt-comments.twig b/...ey/vanilla/views/subviews/printanswers/question_types/template_multiple-opt-comments.twig
@@ -7,14 +7,14 @@
                 {% if subquestion.answervalue is sameas("Y") %}
                     <i class="fa fa-check-square-o"></i>
                 {% else %}
-                    {{subquestion.answervalue}}
+                    {{subquestion.answervalue|escape}}
                 {% endif %}
             </div>
             <div class="col-md-4 text-left">
                 <b>{{subquestion.question}} ({{subquestion.qid}})</b>
             </div>
             <div class="col-md-4 text-left">
-                    {{subquestion.comment.answervalue}}
+                    {{subquestion.comment.answervalue|escape}}
             </div>
         </div>
     {% endfor %}

diff --git a/themes/survey/vanilla/views/subviews/printanswers/question_types/template_multiple-opt.twig b/themes/survey/vanilla/views/subviews/printanswers/question_types/template_multiple-opt.twig
@@ -7,7 +7,7 @@
                 {% if subquestion.answervalue is sameas("Y") %}
                     <i class="fa fa-check-square-o"></i>
                 {% else %}
-                    {{subquestion.answervalue}}
+                    {{subquestion.answervalue|escape}}
                 {% endif %}
             </div>
             <div class="col-md-8 text-left">