From e29b8d4defbdd0239dbe083799e25680ad6fcff6 Mon Sep 17 00:00:00 2001
From: "deepsource-dev-autofix[bot]"
 <61578317+deepsource-dev-autofix[bot]@users.noreply.github.com>
Date: Mon, 14 Jul 2025 15:41:55 +0530
Subject: [PATCH] refactor: sanitize dynamic outputs to prevent reflected xss

---
 include/client/accesslink.inc.php            |  4 ++--
 include/client/login.inc.php                 |  6 +++---
 include/staff/dashboard.inc.php              |  2 +-
 include/staff/templates/org-profile.tmpl.php | 12 ++++++------
 include/staff/templates/task-view.tmpl.php   |  6 ++----
 include/staff/ticket-open.inc.php            |  6 +++---
 include/staff/ticket-view.inc.php            |  2 +-
 open.php                                     |  8 ++++++--
 8 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/include/client/accesslink.inc.php b/include/client/accesslink.inc.php
index 4f5f5ac810..0b4f82adb9 100644
--- a/include/client/accesslink.inc.php
+++ b/include/client/accesslink.inc.php
@@ -25,12 +25,12 @@
     <div>
         <label for="email"><?php echo __('Email Address'); ?>:
         <input id="email" placeholder="<?php echo __('e.g. john.doe@osticket.com'); ?>" type="text"
-            name="lemail" size="30" value="<?php echo $email; ?>" class="nowarn"></label>
+            name="lemail" size="30" value="<?php echo Format::htmlchars($email); ?>" class="nowarn"></label>
     </div>
     <div>
         <label for="ticketno"><?php echo __('Ticket Number'); ?>:
         <input id="ticketno" type="text" name="lticket" placeholder="<?php echo __('e.g. 051243'); ?>"
-            size="30" value="<?php echo $ticketid; ?>" class="nowarn"></label>
+            size="30" value="<?php echo Format::htmlchars($ticketid); ?>" class="nowarn"></label>
     </div>
     <p>
         <input class="btn" type="submit" value="<?php echo $button; ?>">
diff --git a/include/client/login.inc.php b/include/client/login.inc.php
index 98e9feac29..6ada33ecd7 100644
--- a/include/client/login.inc.php
+++ b/include/client/login.inc.php
@@ -23,10 +23,10 @@
     <div class="login-box">
     <strong><?php echo Format::htmlchars($errors['login']); ?></strong>
     <div>
-        <input id="username" placeholder="<?php echo __('Email or Username'); ?>" type="text" name="luser" size="30" value="<?php echo $email; ?>" class="nowarn">
+        <input id="username" placeholder="<?php echo __('Email or Username'); ?>" type="text" name="luser" size="30" value="<?php echo Format::htmlchars($email); ?>" class="nowarn">
     </div>
     <div>
-        <input id="passwd" placeholder="<?php echo __('Password'); ?>" type="password" name="lpasswd" size="30" maxlength="128" value="<?php echo $passwd; ?>" class="nowarn"></td>
+        <input id="passwd" placeholder="<?php echo __('Password'); ?>" type="password" name="lpasswd" size="30" maxlength="128" value="<?php echo Format::htmlchars($passwd); ?>" class="nowarn"></td>
     </div>
     <p>
         <input class="btn" type="submit" value="<?php echo __('Sign In'); ?>">
@@ -55,7 +55,7 @@
     </div>
 <?php } ?>
     <div>
-    <b><?php echo __("I'm an agent"); ?></b> —
+    <b><?php echo "I'm an agent"; ?></b> —
     <a href="<?php echo ROOT_PATH; ?>scp/"><?php echo __('sign in here'); ?></a>
     </div>
     </div>
diff --git a/include/staff/dashboard.inc.php b/include/staff/dashboard.inc.php
index 94e52e7fff..39f8f1f84f 100644
--- a/include/staff/dashboard.inc.php
+++ b/include/staff/dashboard.inc.php
@@ -175,7 +175,7 @@
                 $(this).removeAttr('selected');
             // Set the selected period by the option's value (periods equal
             // option's values)
-            if ($(this).val() == "<?php echo $report->end; ?>")
+            if ($(this).val() == "<?php echo Format::htmlchars($report->end); ?>")
                 $(this).attr("selected","selected");
         });
     <?php } ?>
diff --git a/include/staff/templates/org-profile.tmpl.php b/include/staff/templates/org-profile.tmpl.php
index c430f7d7ba..da71e34791 100644
--- a/include/staff/templates/org-profile.tmpl.php
+++ b/include/staff/templates/org-profile.tmpl.php
@@ -4,14 +4,14 @@
 if (!$info['title'])
     $info['title'] = Format::htmlchars($org->getName());
 ?>
-<h3 class="drag-handle"><?php echo $info['title']; ?></h3>
+<h3 class="drag-handle"><?php echo htmlspecialchars($info['title'], ENT_QUOTES, 'UTF-8'); ?></h3>
 <b><a class="close" href="#"><i class="icon-remove-circle"></i></a></b>
 <hr/>
 <?php
 if ($info['error']) {
-    echo sprintf('<p id="msg_error">%s</p>', $info['error']);
+    echo sprintf('<p id="msg_error">%s</p>', htmlspecialchars($info['error'], ENT_QUOTES, 'UTF-8'));
 } elseif ($info['msg']) {
-    echo sprintf('<p id="msg_notice">%s</p>', $info['msg']);
+    echo sprintf('<p id="msg_notice">%s</p>', htmlspecialchars($info['msg'], ENT_QUOTES, 'UTF-8'));
 } ?>
 <ul class="tabs" id="orgprofile">
     <li class="active"><a href="#profile"
@@ -126,7 +126,7 @@
                     <?php echo __('Primary Contacts'); ?>:
                 </td>
                 <td>
-                    <input type="checkbox" name="collab-pc-flag" value="1" <?php echo $info['collab-pc-flag']?'checked="checked"':''; ?>>
+                    <input type="checkbox" name="collab-pc-flag" value="1" <?php echo $info['collab-pc-flag']?'checked="checked"':''; ?>><
                     <?php echo __('Add to all tickets from this organization'); ?>
                 </td>
             </tr>
@@ -135,7 +135,7 @@
                     <?php echo __('Organization Members'); ?>:
                 </td>
                 <td>
-                    <input type="checkbox" name="collab-all-flag" value="1" <?php echo $info['collab-all-flag']?'checked="checked"':''; ?>>
+                    <input type="checkbox" name="collab-all-flag" value="1" <?php echo $info['collab-all-flag']?'checked="checked"':''; ?>><
                     <?php echo __('Add to all tickets from this organization'); ?>
                 </td>
             </tr>
@@ -151,7 +151,7 @@
                 </td>
                 <td>
                     <input type="text" size="40" maxlength="256" name="domain"
-                        value="<?php echo $info['domain']; ?>" />
+                        value="<?php echo htmlspecialchars($info['domain'], ENT_QUOTES, 'UTF-8'); ?>" />
                     <br/><span class="error"><?php echo $errors['domain']; ?></span>
                 </td>
             </tr>
diff --git a/include/staff/templates/task-view.tmpl.php b/include/staff/templates/task-view.tmpl.php
index 640cdcb856..12dec34833 100644
--- a/include/staff/templates/task-view.tmpl.php
+++ b/include/staff/templates/task-view.tmpl.php
@@ -611,7 +611,7 @@ class="icon-group"></i> <?php echo __('Team'); ?></a>
                         class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
                             ?> draft draft-delete fullscreen" <?php
     list($draft, $attrs) = Draft::getDraftAndDataAttrs('task.response', $task->getId(), $info['task.response']);
-    echo $attrs; ?>><?php echo $draft ?: $info['task.response'];
+    echo $attrs; ?>><?php echo Format::htmlchars($draft ?: $info['task.response']);
                     ?></textarea>
                 <div id="task_response_form_attachments" class="attachments">
                 <?php
@@ -670,9 +670,7 @@ class="tab_content spellcheck save <?php
                         placeholder="<?php echo __('Internal Note details'); ?>"
                         rows="9" wrap="soft" data-draft-namespace="task.note"
                         data-draft-object-id="<?php echo $task->getId(); ?>"
-                        class="richtext ifhtml draft draft-delete fullscreen"><?php
-                        echo $info['note'];
-                        ?></textarea>
+                        class="richtext ifhtml draft draft-delete fullscreen"><?php echo Format::htmlchars($info['note']); ?></textarea>
                     <div class="attachments">
                     <?php
                         if ($note_attachments_form)
diff --git a/include/staff/ticket-open.inc.php b/include/staff/ticket-open.inc.php
index bb28016aab..f9fd0a21f9 100644
--- a/include/staff/ticket-open.inc.php
+++ b/include/staff/ticket-open.inc.php
@@ -99,7 +99,7 @@ function (user) {
                       <?php } ?>
                       <i class="icon-user"></i>
                       <span id="user-name"><?php echo Format::htmlchars($user->getName()); ?></span>
-                      &lt;<span id="user-email"><?php echo $user->getEmail(); ?></span>&gt;
+                      &lt;<span id="user-email"><?php echo Format::htmlchars($user->getEmail()); ?></span>&gt;
                     </a>
                     <a class="inline button" style="overflow:inherit" href="#"
                     onclick="javascript:
@@ -130,7 +130,7 @@ function(user) {
                 onclick="javascript:
                 $.userLookup('ajax.php/users/lookup/form', function (user) {
                   var newUser = new Option(user.email + ' - ' + user.name, user.id, true, true);
-                  return $(&quot;#user-name&quot;).append(newUser).trigger('change');
+                  return $("#user-name").append(newUser).trigger('change');
                 });
                 return false;
                 "><i class="icon-plus"></i> <?php echo __('Add New'); ?></a>
@@ -159,7 +159,7 @@ function(user) {
             onclick="javascript:
             $.userLookup('ajax.php/users/lookup/form', function (user) {
               var newUser = new Option(user.name, user.id, true, true);
-              return $(&quot;#cc_users_open&quot;).append(newUser).trigger('change');
+              return $("#cc_users_open").append(newUser).trigger('change');
             });
             return false;
             "><i class="icon-plus"></i> <?php echo __('Add New'); ?></a>
diff --git a/include/staff/ticket-view.inc.php b/include/staff/ticket-view.inc.php
index fc48c5a9c8..baba4fe36d 100644
--- a/include/staff/ticket-view.inc.php
+++ b/include/staff/ticket-view.inc.php
@@ -1174,7 +1174,7 @@ class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
                         class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
                             ?> draft draft-delete fullscreen" <?php
     list($draft, $attrs) = Draft::getDraftAndDataAttrs('ticket.note', $ticket->getId(), $info['note']);
-    echo $attrs; ?>><?php echo ThreadEntryBody::clean($_POST ? $info['note'] : $draft);
+    echo htmlspecialchars($attrs, ENT_QUOTES, 'UTF-8'); ?>><?php echo htmlspecialchars(ThreadEntryBody::clean($_POST ? $info['note'] : $draft), ENT_QUOTES, 'UTF-8');
                         ?></textarea>
                 <div class="attachments">
                 <?php
diff --git a/open.php b/open.php
index 10f0b0a273..6aca8fd9b2 100644
--- a/open.php
+++ b/open.php
@@ -84,8 +84,12 @@
 ) {
     // Thank the user and promise speedy resolution!
     echo Format::viewableImages(
-        $ticket->replaceVars(
-            $page->getLocalBody()
+        htmlspecialchars(
+            $ticket->replaceVars(
+                $page->getLocalBody()
+            ),
+            ENT_QUOTES,
+            'UTF-8'
         ),
         ['type' => 'P']
     );