Skip to content

refactor: sanitize dynamic outputs to prevent reflected xss #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deepsource-dev-autofix wants to merge 1 commit into
base: v1.18.1-base
Choose a base branch
from
Open

refactor: sanitize dynamic outputs to prevent reflected xss #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions include/client/accesslink.inc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,12 @@
<div>
<label for="email"><?php echo __('Email Address'); ?>:
<input id="email" placeholder="<?php echo __('e.g. john.doe@osticket.com'); ?>" type="text"
name="lemail" size="30" value="<?php echo $email; ?>" class="nowarn"></label>
name="lemail" size="30" value="<?php echo Format::htmlchars($email); ?>" class="nowarn"></label>
</div>
<div>
<label for="ticketno"><?php echo __('Ticket Number'); ?>:
<input id="ticketno" type="text" name="lticket" placeholder="<?php echo __('e.g. 051243'); ?>"
size="30" value="<?php echo $ticketid; ?>" class="nowarn"></label>
size="30" value="<?php echo Format::htmlchars($ticketid); ?>" class="nowarn"></label>
</div>
<p>
<input class="btn" type="submit" value="<?php echo $button; ?>">
Expand Down
6 changes: 3 additions & 3 deletions include/client/login.inc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@
<div class="login-box">
<strong><?php echo Format::htmlchars($errors['login']); ?></strong>
<div>
<input id="username" placeholder="<?php echo __('Email or Username'); ?>" type="text" name="luser" size="30" value="<?php echo $email; ?>" class="nowarn">
<input id="username" placeholder="<?php echo __('Email or Username'); ?>" type="text" name="luser" size="30" value="<?php echo Format::htmlchars($email); ?>" class="nowarn">
</div>
<div>
<input id="passwd" placeholder="<?php echo __('Password'); ?>" type="password" name="lpasswd" size="30" maxlength="128" value="<?php echo $passwd; ?>" class="nowarn"></td>
<input id="passwd" placeholder="<?php echo __('Password'); ?>" type="password" name="lpasswd" size="30" maxlength="128" value="<?php echo Format::htmlchars($passwd); ?>" class="nowarn"></td>
</div>
<p>
<input class="btn" type="submit" value="<?php echo __('Sign In'); ?>">
Expand Down Expand Up @@ -55,7 +55,7 @@
</div>
<?php } ?>
<div>
<b><?php echo __("I'm an agent"); ?></b> —
<b><?php echo "I'm an agent"; ?></b> —
<a href="<?php echo ROOT_PATH; ?>scp/"><?php echo __('sign in here'); ?></a>
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion include/staff/dashboard.inc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@
$(this).removeAttr('selected');
// Set the selected period by the option's value (periods equal
// option's values)
if ($(this).val() == "<?php echo $report->end; ?>")
if ($(this).val() == "<?php echo Format::htmlchars($report->end); ?>")
$(this).attr("selected","selected");
});
<?php } ?>
Expand Down
12 changes: 6 additions & 6 deletions include/staff/templates/org-profile.tmpl.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,14 @@
if (!$info['title'])
$info['title'] = Format::htmlchars($org->getName());
?>
<h3 class="drag-handle"><?php echo $info['title']; ?></h3>
<h3 class="drag-handle"><?php echo htmlspecialchars($info['title'], ENT_QUOTES, 'UTF-8'); ?></h3>
<b><a class="close" href="#"><i class="icon-remove-circle"></i></a></b>
<hr/>
<?php
if ($info['error']) {
echo sprintf('<p id="msg_error">%s</p>', $info['error']);
echo sprintf('<p id="msg_error">%s</p>', htmlspecialchars($info['error'], ENT_QUOTES, 'UTF-8'));
} elseif ($info['msg']) {
echo sprintf('<p id="msg_notice">%s</p>', $info['msg']);
echo sprintf('<p id="msg_notice">%s</p>', htmlspecialchars($info['msg'], ENT_QUOTES, 'UTF-8'));
} ?>
<ul class="tabs" id="orgprofile">
<li class="active"><a href="#profile"
Expand Down Expand Up @@ -126,7 +126,7 @@
<?php echo __('Primary Contacts'); ?>:
</td>
<td>
<input type="checkbox" name="collab-pc-flag" value="1" <?php echo $info['collab-pc-flag']?'checked="checked"':''; ?>>
<input type="checkbox" name="collab-pc-flag" value="1" <?php echo $info['collab-pc-flag']?'checked="checked"':''; ?>><
<?php echo __('Add to all tickets from this organization'); ?>
</td>
</tr>
Expand All @@ -135,7 +135,7 @@
<?php echo __('Organization Members'); ?>:
</td>
<td>
<input type="checkbox" name="collab-all-flag" value="1" <?php echo $info['collab-all-flag']?'checked="checked"':''; ?>>
<input type="checkbox" name="collab-all-flag" value="1" <?php echo $info['collab-all-flag']?'checked="checked"':''; ?>><
<?php echo __('Add to all tickets from this organization'); ?>
</td>
</tr>
Expand All @@ -151,7 +151,7 @@
</td>
<td>
<input type="text" size="40" maxlength="256" name="domain"
value="<?php echo $info['domain']; ?>" />
value="<?php echo htmlspecialchars($info['domain'], ENT_QUOTES, 'UTF-8'); ?>" />
<br/><span class="error"><?php echo $errors['domain']; ?></span>
</td>
</tr>
Expand Down
6 changes: 2 additions & 4 deletions include/staff/templates/task-view.tmpl.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -611,7 +611,7 @@ class="icon-group"></i> <?php echo __('Team'); ?></a>
class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
?> draft draft-delete fullscreen" <?php
list($draft, $attrs) = Draft::getDraftAndDataAttrs('task.response', $task->getId(), $info['task.response']);
echo $attrs; ?>><?php echo $draft ?: $info['task.response'];
echo $attrs; ?>><?php echo Format::htmlchars($draft ?: $info['task.response']);
?></textarea>
<div id="task_response_form_attachments" class="attachments">
<?php
Expand Down Expand Up @@ -670,9 +670,7 @@ class="tab_content spellcheck save <?php
placeholder="<?php echo __('Internal Note details'); ?>"
rows="9" wrap="soft" data-draft-namespace="task.note"
data-draft-object-id="<?php echo $task->getId(); ?>"
class="richtext ifhtml draft draft-delete fullscreen"><?php
echo $info['note'];
?></textarea>
class="richtext ifhtml draft draft-delete fullscreen"><?php echo Format::htmlchars($info['note']); ?></textarea>
<div class="attachments">
<?php
if ($note_attachments_form)
Expand Down
6 changes: 3 additions & 3 deletions include/staff/ticket-open.inc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ function (user) {
<?php } ?>
<i class="icon-user"></i>
<span id="user-name"><?php echo Format::htmlchars($user->getName()); ?></span>
&lt;<span id="user-email"><?php echo $user->getEmail(); ?></span>&gt;
&lt;<span id="user-email"><?php echo Format::htmlchars($user->getEmail()); ?></span>&gt;
</a>
<a class="inline button" style="overflow:inherit" href="#"
onclick="javascript:
Expand Down Expand Up @@ -130,7 +130,7 @@ function(user) {
onclick="javascript:
$.userLookup('ajax.php/users/lookup/form', function (user) {
var newUser = new Option(user.email + ' - ' + user.name, user.id, true, true);
return $(&quot;#user-name&quot;).append(newUser).trigger('change');
return $("#user-name").append(newUser).trigger('change');
});
return false;
"><i class="icon-plus"></i> <?php echo __('Add New'); ?></a>
Expand Down Expand Up @@ -159,7 +159,7 @@ function(user) {
onclick="javascript:
$.userLookup('ajax.php/users/lookup/form', function (user) {
var newUser = new Option(user.name, user.id, true, true);
return $(&quot;#cc_users_open&quot;).append(newUser).trigger('change');
return $("#cc_users_open").append(newUser).trigger('change');
});
return false;
"><i class="icon-plus"></i> <?php echo __('Add New'); ?></a>
Expand Down
2 changes: 1 addition & 1 deletion include/staff/ticket-view.inc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1174,7 +1174,7 @@ class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
class="<?php if ($cfg->isRichTextEnabled()) echo 'richtext';
?> draft draft-delete fullscreen" <?php
list($draft, $attrs) = Draft::getDraftAndDataAttrs('ticket.note', $ticket->getId(), $info['note']);
echo $attrs; ?>><?php echo ThreadEntryBody::clean($_POST ? $info['note'] : $draft);
echo htmlspecialchars($attrs, ENT_QUOTES, 'UTF-8'); ?>><?php echo htmlspecialchars(ThreadEntryBody::clean($_POST ? $info['note'] : $draft), ENT_QUOTES, 'UTF-8');
?></textarea>
<div class="attachments">
<?php
Expand Down
8 changes: 6 additions & 2 deletions open.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,12 @@
) {
// Thank the user and promise speedy resolution!
echo Format::viewableImages(
$ticket->replaceVars(
$page->getLocalBody()
htmlspecialchars(
$ticket->replaceVars(
$page->getLocalBody()
),
ENT_QUOTES,
'UTF-8'
),
['type' => 'P']
);
Expand Down