Fixed issue #18967: [security] User can add malicious content in User…

… Roles (#3292)
LimeSurvey · Jul 26, 2023 · e4ce838 · e4ce838
1 parent 61c3d5a
commit e4ce838
Show file tree

Hide file tree

Showing 7 changed files with 8 additions and 8 deletions.
diff --git a/application/models/Permissiontemplates.php b/application/models/Permissiontemplates.php
@@ -214,7 +214,7 @@ public function getButtons(): string
                 'data-bs-toggle' => "modal",
                 'data-post-url'  => $deleteUrl,
                 'data-post-datas' => $deletePostData,
-                'data-message'   => sprintf(gt("Are you sure you want to delete user role '%s'?"), $this->name),
+                'data-message'   => sprintf(gt("Are you sure you want to delete user role '%s'?"), CHtml::encode($this->name)),
                 'data-bs-target' => "#confirmation-modal",
                 'data-btnclass'  => 'btn-danger',
                 'data-btntext'   => gt('Delete'),

diff --git a/application/views/userRole/edit.php b/application/views/userRole/edit.php
@@ -8,7 +8,7 @@
         <?php if($model->isNewRecord) {
             echo gT('Create permission roles');
         } else {
-            echo sprintf(gT('Update permission roles %s'), $model->name);
+            echo sprintf(gT('Update permission roles %s'), CHtml::encode($model->name));
         }?>
     </div>
     <div class="col-12 ls-space margin top-15">

diff --git a/application/views/userRole/partials/_form.php b/application/views/userRole/partials/_form.php
@@ -8,7 +8,7 @@
     $modalTitle =  gT('Create permission role');
     $buttonTitle = gT('Create');
 } else {
-    $modalTitle = sprintf(gT("Edit permission role '%s'"), $model->name);
+    $modalTitle = sprintf(gT("Edit permission role '%s'"), CHtml::encode($model->name));
     $buttonTitle = gT('Save');
 }
 Yii::app()->getController()->renderPartial(

diff --git a/application/views/userRole/partials/_view.php b/application/views/userRole/partials/_view.php
@@ -4,15 +4,15 @@
 ?>
 
 <div class="modal-header">
-    <h5 class="modal-title" id="modalTitle-addedit"><?= sprintf(gT('Permission role %s'), $oModel->name); ?></h5>
+    <h5 class="modal-title" id="modalTitle-addedit"><?= sprintf(gT('Permission role %s'), CHtml::encode($oModel->name)); ?></h5>
     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 </div>
 <div class="modal-body">
     <div class="row">
         <div class="col-12">
             <div class="card">
                 <div class="col-12 card-body">
-                    <?= $oModel->description ?>
+                    <?= CHtml::encode($oModel->description) ?>
                 </div>
             </div>
         </div>

diff --git a/assets/packages/adminbasics/build/adminbasics.js b/assets/packages/adminbasics/build/adminbasics.js
@@ -17886,7 +17886,7 @@
 	  //Current options object
 	  const options = _parseOptions(e);
 	  //Set the message if available
-	  $(this).find('.modal-body-text').html(options.message);
+	  $(this).find('.modal-body-text').text(options.message);
 	  //first remove both classes
 	  $(this).find('.btn-ok').removeClass("btn-primary btn-danger");
 	  if (options.btnclass !== null) {

diff --git a/assets/packages/adminbasics/build/adminbasics.min.js b/assets/packages/adminbasics/build/adminbasics.min.js
diff --git a/assets/packages/adminbasics/src/parts/confirmationModal.js b/assets/packages/adminbasics/src/parts/confirmationModal.js
@@ -112,7 +112,7 @@ const ConfirmationModal = function(e){
     //Current options object
     const options = _parseOptions(e);
     //Set the message if available
-    $(this).find('.modal-body-text').html(options.message);
+    $(this).find('.modal-body-text').text(options.message);
     //first remove both classes
     $(this).find('.btn-ok').removeClass("btn-primary btn-danger");
     if (options.btnclass !== null) {