Fixed issue [security] #17793: Non filtred HTML shown for Question At…

…tribute (#2184) Fixed issue #17794: Language attribute are not shown in question summary Dev: get the good array param Dev: usage of viewHelper::stripTagsEM
LimeSurvey · Dec 22, 2021 · e419cc3 · e419cc3
1 parent fb950c7
commit e419cc3
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 11 deletions.
diff --git a/application/controllers/admin/questions.php b/application/controllers/admin/questions.php
@@ -82,8 +82,11 @@ public function view($surveyid, $gid, $qid)
         $DisplayArray = array();
 
         foreach ($aAttributesWithValues as $aAttribute) {
-            if (($aAttribute['i18n'] == false && isset($aAttribute['value']) && $aAttribute['value'] != $aAttribute['default'])
-                || ($aAttribute['i18n'] == true && isset($aAttribute['value'][$baselang]) && $aAttribute['value'][$baselang] != $aAttribute['default'])) {
+            if (
+                ($aAttribute['i18n'] == false && isset($aAttribute['value']) && $aAttribute['value'] != $aAttribute['default'])
+                ||
+                ($aAttribute['i18n'] == true && isset($aAttribute[$baselang]['value']) && $aAttribute[$baselang]['value'] != $aAttribute['default'])
+            ) {
                 if ($aAttribute['inputtype'] == 'singleselect') {
                     if (isset($aAttribute['options'][$aAttribute['value']])) {
                         $aAttribute['value'] = $aAttribute['options'][$aAttribute['value']];

diff --git a/application/views/admin/survey/Question/question_view.php b/application/views/admin/survey/Question/question_view.php
@@ -1,4 +1,4 @@
-<?php
+-<?php
 /** @var Question $oQuestion */
 ?>
 <div class='side-body <?php echo getSideBodyClass(true); ?>'>
@@ -200,19 +200,19 @@
                             </td>
                             <td>
                                 <?php
+                                    $value = $aAdvancedSetting['value'];
+                                    if ($aAdvancedSetting['i18n']) {
+                                        $value = $aAdvancedSetting[$baselang]['value'];
+                                    }
                                     if (isset($aAdvancedSetting['expression']) && $aAdvancedSetting['expression'] > 0) {
                                         if ($aAdvancedSetting['expression'] == 1) {
-                                            LimeExpressionManager::ProcessString($aAdvancedSetting['value'], $qid);
+                                            LimeExpressionManager::ProcessString($value, $qid);
                                         } else {
-                                            LimeExpressionManager::ProcessString('{' . $aAdvancedSetting['value'] . '}', $qid);
+                                            LimeExpressionManager::ProcessString('{' . $value . '}', $qid);
                                         }
-                                        echo LimeExpressionManager::GetLastPrettyPrintExpression();
+                                        echo viewHelper::stripTagsEM(LimeExpressionManager::GetLastPrettyPrintExpression());
                                     } else {
-                                        if ($aAdvancedSetting['i18n']==false){
-                                            echo htmlspecialchars($aAdvancedSetting['value']);
-                                        } else {
-                                            echo htmlspecialchars($aAdvancedSetting[$baselang]['value']);
-                                        }
+                                        echo CHtml::encode($value);
                                     }
                                 ?>
                             </td>