Fixed issue [security] #15720: Reflected Cross-Site Scripting in posi…

…tion widget (Maxime Roy)

application/controllers/admin/questions.php

@@ -1284,7 +1284,8 @@ public function ajaxReloadPositionWidget($gid, $classes = '')
 
             );
 
-            if ($classes != '') {
+            // TODO: Better solution: Hard-code allowed CSS classes.
+            if ($classes != '' && $this->isValidCSSClass($classes)) {
                 $aOptions['classes'] = $classes;
             }
 
@@ -1540,6 +1541,18 @@ public function ajaxGetQuestionTemplateList()
         Yii::app()->end();
     }
 
+    /**
+     * Returns true if $class is a valid CSS class (alphanumeric + '-' and '_')
+     *
+     * @param string $class
+     * @return boolean
+     */
+    protected function isValidCSSClass($class)
+    {
+        $class = str_replace(['-', '_'], '', $class);
+        return ctype_alnum($class);
+    }
+
     /**
      * Renders template(s) wrapped in header and footer
      *