bugfix: avoid XSS in user name presentation (LMS #1910)

chilek · Apr 28, 2021 · 72427bd · 72427bd
1 parent ce6c7a3
commit 72427bd
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 6 deletions.
diff --git a/templates/default/invoice/invoice.html b/templates/default/invoice/invoice.html
@@ -450,7 +450,7 @@
 		</TD>
 		<TD WIDTH="50%" ALIGN="RIGHT" ROWSPAN="2">
 			{if !ConfigHelper::checkConfig('invoices.hide_expositor')}
-				{trans("Expositor:")} {if $invoice.user}{$invoice.user}{elseif $invoice.division_author}{$invoice.division_author}{else}{trans("system")}{/if}
+				{trans("Expositor:")} {if $invoice.user}{$invoice.user|escape}{elseif $invoice.division_author}{$invoice.division_author|escape}{else}{trans("system")}{/if}
 			{/if}
 		</TD>
 	</TR>

diff --git a/templates/default/note/note.html b/templates/default/note/note.html
@@ -5,7 +5,7 @@
 <BR>
 {trans("Deadline:")} {$note.pdate|date_format:"%Y/%m/%d"}
 <BR>
-{trans("Expositor:")} {if $note.user}{$note.user}{else}{$note.division_author}{/if}
+{trans("Expositor:")} {if $note.user}{$note.user|escape}{else}{$note.division_author|escape}{/if}
 </DIV>
 
 <H2 align="center" class="hdf">

diff --git a/templates/default/user/useradd.html b/templates/default/user/useradd.html
@@ -53,15 +53,15 @@ <H1>{$layout.pagetitle}</H1>
 			<IMG src="img/users.gif" alt=""> {trans("First name:")}
 		</TD>
 		<TD>
-			<INPUT type="text" name="useradd[firstname]" value="{$useradd.firstname}" size="40" required {tip text="Enter user first name" trigger="firstname"}>
+			<INPUT type="text" name="useradd[firstname]" value="{$useradd.firstname|escape}" size="40" required {tip text="Enter user first name" trigger="firstname"}>
 		</TD>
 	</TR>
 	<TR>
 		<TD class="bold nobr">
 			<IMG src="img/users.gif" alt=""> {trans("Last name:")}
 		</TD>
 		<TD>
-			<INPUT type="text" name="useradd[lastname]" value="{$useradd.lastname}" size="40" required {tip text="Enter user last name" trigger="lastname"}>
+			<INPUT type="text" name="useradd[lastname]" value="{$useradd.lastname|escape}" size="40" required {tip text="Enter user last name" trigger="lastname"}>
 		</TD>
 	</TR>
 	<TR>

diff --git a/templates/default/user/usereditbox.html b/templates/default/user/usereditbox.html
@@ -53,7 +53,7 @@
 			{trans("First name:")}
 		</TD>
 		<TD>
-			<INPUT type="text" name="userinfo[firstname]" value="{$userinfo.firstname}" required size="40" {tip text="Enter user first name" trigger="firstname"}>
+			<INPUT type="text" name="userinfo[firstname]" value="{$userinfo.firstname|escape}" required size="40" {tip text="Enter user first name" trigger="firstname"}>
 		</TD>
 	</TR>
 	<TR>
@@ -64,7 +64,7 @@
 			{trans("Last name:")}
 		</TD>
 		<TD>
-			<INPUT type="text" name="userinfo[lastname]" value="{$userinfo.lastname}" required size="40" {tip text="Enter user last name" trigger="lastname"}>
+			<INPUT type="text" name="userinfo[lastname]" value="{$userinfo.lastname|escape}" required size="40" {tip text="Enter user last name" trigger="lastname"}>
 		</TD>
 	</TR>
 	<TR>