[security] Fixed issue #14376: XSS in Survey Resource zip upload

[security] Fixed issue : XSS in theme zip upload Dev: CHtml::encode filename (whole) when view Dev: Same with import theme Dev: some other fix to do : reporting issues
LimeSurvey · Dec 21, 2018 · bfee69e · bfee69e
1 parent 73fe91e
commit bfee69e
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 16 deletions.
diff --git a/application/views/admin/survey/importSurveyResources_view.php b/application/views/admin/survey/importSurveyResources_view.php
@@ -19,9 +19,8 @@
                 <p>
                     <ul>
                         <?php
-                        foreach ($aImportedFilesInfo as $entry)
-                        {
-                            echo CHtml::tag('li', array(), gT("File") . ': ' . $entry["filename"]);
+                        foreach ($aImportedFilesInfo as $entry) {
+                            echo CHtml::tag('li', array(), sprintf(gT("File: %s"),CHtml::encode($entry["filename"])));
                         }
                         ?>
                     </ul>
@@ -55,9 +54,8 @@
                     <p>
                         <ul>
                             <?php
-                            foreach ($aImportedFilesInfo as $entry)
-                            {
-                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry["filename"]);
+                            foreach ($aImportedFilesInfo as $entry) {
+                                echo CHtml::tag('li', array(), sprintf(gT("File: %s"),CHtml::encode($entry["filename"])));
                             }
                             ?>
                         </ul>
@@ -67,9 +65,8 @@
                     </p>
                     <p>
                         <?php
-                            foreach ($aErrorFilesInfo as $entry)
-                            {
-                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry['filename'] . " (" . $entry['status'] . ")");
+                            foreach ($aErrorFilesInfo as $entry) {
+                                echo CHtml::tag('li', array(), sprintf(gT("File: %s (%s)"),CHtml::encode($entry["filename"]),$entry['status']));
                             }
                         ?>
                         </ul>
@@ -102,9 +99,8 @@
                     </p>
                     <p>
                         <?php
-                            foreach ($aErrorFilesInfo as $entry)
-                            {
-                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry['filename'] . " (" . $entry['status'] . ")");
+                            foreach ($aErrorFilesInfo as $entry) {
+                                echo CHtml::tag('li', array(), sprintf(gT("File: %s (%s)"),CHtml::encode($entry["filename"]),$entry['status']));
                             }
                         ?>
                         </ul>

diff --git a/application/views/admin/themes/importuploaded_view.php b/application/views/admin/themes/importuploaded_view.php
@@ -52,12 +52,12 @@
                             {
                                 if ($entry['is_folder']){
                                 ?>
-                                <li><?php echo gT("Folder:") . " " . htmlspecialchars($entry["filename"],ENT_QUOTES,'utf-8'); ?></li>
+                                <li><?php printf(gT("Folder: %s"),CHtml::encode($entry["filename"])); ?></li>
                                 <?php
                                 }
                                 else
                                 { ?>
-                                <li><?php echo gT("File:") . " " . htmlspecialchars($entry["filename"],ENT_QUOTES,'utf-8'); ?></li>
+                                <li><?php printf(gT("File: %s"),CHtml::encode($entry["filename"])); ?></li>
 
 
                                 <?php
@@ -74,7 +74,7 @@
                             foreach ($aErrorFilesInfo as $entry)
                             {
                             ?>
-                            <li><?php echo gT("File:") . " " . $entry["filename"] ?></li>
+                            <li><?php printf(gT("File: %s"),CHtml::encode($entry["filename"])); ?></li>
                             <?php
                             }
                         }

diff --git a/application/views/admin/themes/templatesummary_view.php b/application/views/admin/themes/templatesummary_view.php
@@ -126,7 +126,7 @@
                 <?php foreach ($otherfiles as $fileName => $file) { ?>
                     <div class="row other-files-row">
                         <div class="col-sm-9 other-files-filename">
-                            <?php echo (empty(substr(strrchr($file, DIRECTORY_SEPARATOR), 1)))?$file:substr(strrchr($file, DIRECTORY_SEPARATOR), 1) ;?>
+                            <?php echo CHtml::encode((empty(substr(strrchr($file, DIRECTORY_SEPARATOR), 1)))?$file:substr(strrchr($file, DIRECTORY_SEPARATOR), 1)) ;?>
                         </div>
                         <div class="col-sm-3">
                             <?php //TODO: make it ajax and less messy ?>