- added htmlentities (XSS protection) to form data passed to template, fixes #4902

Marius Burkard · Marius Burkard · commit 9a7981e01e0f · 2018-01-01T11:35:56.000+01:00
diff --git a/interface/lib/classes/tform_actions.inc.php b/interface/lib/classes/tform_actions.inc.php
@@ -287,7 +287,7 @@ function onError() {
 		global $app, $conf;
 
 		$app->tpl->setVar("error", "<li>".$app->tform->errorMessage."</li>");
-		$app->tpl->setVar($this->dataRecord);
+		$app->tpl->setVar($this->dataRecord, null, true);
 		$this->onShow();
 	}
 
diff --git a/interface/lib/classes/tpl.inc.php b/interface/lib/classes/tpl.inc.php
@@ -226,21 +226,26 @@ public function newTemplate($tmplfile)
 		 * using the keys as variable names and the values as variable values.
 		 * @param mixed $k key to define variable name
 		 * @param mixed $v variable to assign to $k
+		 * @param bool $encode if set to true use htmlentities on values
 		 * @return boolean true/false
 		 * @access public
 		 */
-		public function setVar($k, $v = null)
+		public function setVar($k, $v = null, $encode = false)
 		{
+			global $app;
+			
 			if (is_array($k)) {
 				foreach($k as $key => $value){
 					$key = ($this->OPTIONS['CASELESS']) ? strtolower(trim($key)) : trim($key);
 					if (preg_match('/^[A-Za-z_]+[A-Za-z0-9_]*$/', $key) && $value !== null ) {
+						if($encode == true) $value = $app->functions->htmlentities($value);
 						$this->_vars[$key] = $value;
 					}
 				}
 			} else {
 				if (preg_match('/^[A-Za-z_]+[A-Za-z0-9_]*$/', $k) && $v !== null) {
 					if ($this->OPTIONS['CASELESS']) $k = strtolower($k);
+					if($encode == true) $value = $app->functions->htmlentities($);
 					$this->_vars[trim($k)] = $v;
 				} else {
 					return false;
diff --git a/interface/web/admin/directive_snippets_edit.php b/interface/web/admin/directive_snippets_edit.php
@@ -70,9 +70,9 @@ function onShowEnd() {
 		if($this->id > 0){
 			if($this->dataRecord['master_directive_snippets_id'] > 0){
 				$is_master = true;
-				$app->tpl->setVar("name", $this->dataRecord['name']);
-				$app->tpl->setVar("type", $this->dataRecord['type']);
-				$app->tpl->setVar("snippet", $this->dataRecord['snippet']);
+				$app->tpl->setVar("name", $this->dataRecord['name'], true);
+				$app->tpl->setVar("type", $this->dataRecord['type'], true);
+				$app->tpl->setVar("snippet", $this->dataRecord['snippet'], true);
 			}
 		}
 		$app->tpl->setVar("is_master", $is_master);
diff --git a/interface/web/dns/dns_slave_edit.php b/interface/web/dns/dns_slave_edit.php
@@ -149,7 +149,7 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
+			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/dns/dns_soa_edit.php b/interface/web/dns/dns_soa_edit.php
@@ -217,7 +217,7 @@ function onShowEnd() {
 	if($this->id > 0) {
 		//* we are editing a existing record
 		$app->tpl->setVar("edit_disabled", 1);
-		$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
+		$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
 
 		$datalog = $app->db->queryOneRecord("SELECT sys_datalog.error, sys_log.tstamp FROM sys_datalog, sys_log WHERE sys_datalog.dbtable = 'dns_soa' AND sys_datalog.dbidx = ? AND sys_datalog.datalog_id = sys_log.datalog_id AND sys_log.message = CONCAT('Processed datalog_id ',sys_log.datalog_id) ORDER BY sys_datalog.tstamp DESC", 'id:' . $this->id);
 		if(is_array($datalog) && !empty($datalog)){
diff --git a/interface/web/mail/mail_domain_edit.php b/interface/web/mail/mail_domain_edit.php
@@ -204,7 +204,7 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
+			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/mail/mail_mailinglist_edit.php b/interface/web/mail/mail_mailinglist_edit.php
@@ -124,9 +124,9 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("listname_value", $this->dataRecord["listname"]);
-			$app->tpl->setVar("domain_value", $this->dataRecord["domain"]);
-			$app->tpl->setVar("email_value", $this->dataRecord["email"]);
+			$app->tpl->setVar("listname_value", $this->dataRecord["listname"], true);
+			$app->tpl->setVar("domain_value", $this->dataRecord["domain"], true);
+			$app->tpl->setVar("email_value", $this->dataRecord["email"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/mail/mail_user_edit.php b/interface/web/mail/mail_user_edit.php
@@ -121,7 +121,7 @@ function onShowEnd() {
 		if($this->dataRecord['autoresponder_subject'] == '') {
 			$app->tpl->setVar('autoresponder_subject', $app->tform->lng('autoresponder_subject'));
 		} else {
-			$app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject']);
+			$app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject'], true);
 		}
 
 		$app->uses('getconf');
diff --git a/interface/web/mail/xmpp_domain_edit.php b/interface/web/mail/xmpp_domain_edit.php
@@ -211,7 +211,7 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
+			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/mailuser/mail_user_autoresponder_edit.php b/interface/web/mailuser/mail_user_autoresponder_edit.php
@@ -84,7 +84,7 @@ function onShowEnd() {
 		if($this->dataRecord['autoresponder_subject'] == '') {
 			$app->tpl->setVar('autoresponder_subject', $app->tform->lng('autoresponder_subject'));
 		} else {
-			$app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject']);
+			$app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject'], true);
 		}
 
 		parent::onShowEnd();
diff --git a/interface/web/sites/cron_edit.php b/interface/web/sites/cron_edit.php
@@ -73,7 +73,7 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"]);
+			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/sites/database_edit.php b/interface/web/sites/database_edit.php
@@ -143,22 +143,22 @@ function onShowEnd() {
 
 		if ($this->dataRecord['database_name'] != ""){
 			/* REMOVE the restriction */
-			$app->tpl->setVar("database_name", $app->tools_sites->removePrefix($this->dataRecord['database_name'], $this->dataRecord['database_name_prefix'], $dbname_prefix));
+			$app->tpl->setVar("database_name", $app->tools_sites->removePrefix($this->dataRecord['database_name'], $this->dataRecord['database_name_prefix'], $dbname_prefix), true);
 		}
 
 		if($this->dataRecord['database_name'] == "") {
 			$app->tpl->setVar("database_name_prefix", $dbname_prefix);
 		} else {
-			$app->tpl->setVar("database_name_prefix", $app->tools_sites->getPrefix($this->dataRecord['database_name_prefix'], $dbname_prefix, $global_config['dbname_prefix']));
+			$app->tpl->setVar("database_name_prefix", $app->tools_sites->getPrefix($this->dataRecord['database_name_prefix'], $dbname_prefix, $global_config['dbname_prefix']), true);
 		}
 
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$edit_disabled = @($_SESSION["s"]["user"]["typ"] == 'admin')? 0 : 1; //* admin can change the database-name
 			$app->tpl->setVar("edit_disabled", $edit_disabled);
-			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
-			$app->tpl->setVar("database_charset_value", $this->dataRecord["database_charset"]);
-			$app->tpl->setVar("limit_database_quota", $this->dataRecord["database_quota"]);
+			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
+			$app->tpl->setVar("database_charset_value", $this->dataRecord["database_charset"], true);
+			$app->tpl->setVar("limit_database_quota", $this->dataRecord["database_quota"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/sites/database_user_edit.php b/interface/web/sites/database_user_edit.php
@@ -118,13 +118,13 @@ function onShowEnd() {
 
 		if ($this->dataRecord['database_user'] != ""){
 			/* REMOVE the restriction */
-			$app->tpl->setVar("database_user", $app->tools_sites->removePrefix($this->dataRecord['database_user'], $this->dataRecord['database_user_prefix'], $dbuser_prefix));
+			$app->tpl->setVar("database_user", $app->tools_sites->removePrefix($this->dataRecord['database_user'], $this->dataRecord['database_user_prefix'], $dbuser_prefix), true);
 		}
 
 		if($this->dataRecord['database_user'] == "") {
 			$app->tpl->setVar("database_user_prefix", $dbuser_prefix);
 		} else {
-			$app->tpl->setVar("database_user_prefix", $app->tools_sites->getPrefix($this->dataRecord['database_user_prefix'], $dbuser_prefix, $global_config['dbuser_prefix']));
+			$app->tpl->setVar("database_user_prefix", $app->tools_sites->getPrefix($this->dataRecord['database_user_prefix'], $dbuser_prefix, $global_config['dbuser_prefix']), true);
 		}
 
 		parent::onShowEnd();
diff --git a/interface/web/sites/ftp_user_edit.php b/interface/web/sites/ftp_user_edit.php
@@ -79,13 +79,13 @@ function onShowEnd() {
 
 		if ($this->dataRecord['username'] != ""){
 			/* REMOVE the restriction */
-			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $ftpuser_prefix));
+			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $ftpuser_prefix), true);
 		}
 
 		if($this->dataRecord['username'] == "") {
 			$app->tpl->setVar("username_prefix", $ftpuser_prefix);
 		} else {
-			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $ftpuser_prefix, $global_config['ftpuser_prefix']));
+			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $ftpuser_prefix, $global_config['ftpuser_prefix']), true);
 		}
 
 		parent::onShowEnd();
diff --git a/interface/web/sites/shell_user_edit.php b/interface/web/sites/shell_user_edit.php
@@ -79,19 +79,19 @@ function onShowEnd() {
 
 		if ($this->dataRecord['username'] != ""){
 			/* REMOVE the restriction */
-			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $shelluser_prefix));
+			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $shelluser_prefix), true);
 		}
 
 		if($this->dataRecord['username'] == "") {
 			$app->tpl->setVar("username_prefix", $shelluser_prefix);
 		} else {
-			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $shelluser_prefix, $global_config['shelluser_prefix']));
+			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $shelluser_prefix, $global_config['shelluser_prefix']), true);
 		}
 
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"]);
+			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/sites/web_childdomain_edit.php b/interface/web/sites/web_childdomain_edit.php
@@ -144,7 +144,7 @@ function onShowEnd() {
 				$this->dataRecord["domain"] = str_replace('.'.$parent_domain["domain"], '', $this->dataRecord["domain"]);
 			}
 		}
-		if($this->_childdomain_type == 'subdomain') $app->tpl->setVar("domain", $this->dataRecord["domain"]);
+		if($this->_childdomain_type == 'subdomain') $app->tpl->setVar("domain", $this->dataRecord["domain"], true);
 
 		$client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
 		if($_SESSION["s"]["user"]["typ"] != 'admin' && !$app->auth->has_clients($_SESSION['s']['user']['userid'])) {
diff --git a/interface/web/sites/web_vhost_domain_edit.php b/interface/web/sites/web_vhost_domain_edit.php
@@ -761,8 +761,8 @@ function onShowEnd() {
 			$app->tpl->setVar("edit_disabled", 1);
 			$app->tpl->setVar('fixed_folder', 'y');
 			if($this->_vhostdomain_type == 'domain') {
-				$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
-				$app->tpl->setVar("document_root", $this->dataRecord["document_root"]);
+				$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
+				$app->tpl->setVar("document_root", $this->dataRecord["document_root"], true);
 			}
 			else $app->tpl->setVar('server_id_value', $parent_domain['server_id']);
 		} else {
@@ -820,7 +820,7 @@ function onShowEnd() {
 			if($this->dataRecord["type"] == 'vhostsubdomain') $this->dataRecord["domain"] = str_replace('.'.$parent_domain["domain"], '', $this->dataRecord["domain"]);
 		}
 		
-		if($this->_vhostdomain_type != 'domain') $app->tpl->setVar("domain", $this->dataRecord["domain"]);
+		if($this->_vhostdomain_type != 'domain') $app->tpl->setVar("domain", $this->dataRecord["domain"], true);
 
 		// check for configuration errors in sys_datalog
 		if($this->id > 0) {
diff --git a/interface/web/sites/webdav_user_edit.php b/interface/web/sites/webdav_user_edit.php
@@ -78,19 +78,19 @@ function onShowEnd() {
 
 		if ($this->dataRecord['username'] != "") {
 			/* REMOVE the restriction */
-			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $webdavuser_prefix));
+			$app->tpl->setVar("username", $app->tools_sites->removePrefix($this->dataRecord['username'], $this->dataRecord['username_prefix'], $webdavuser_prefix), true);
 		}
 
 		if($this->dataRecord['username'] == "") {
 			$app->tpl->setVar("username_prefix", $webdavuser_prefix);
 		} else {
-			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $webdavuser_prefix, $global_config['webdavuser_prefix']));
+			$app->tpl->setVar("username_prefix", $app->tools_sites->getPrefix($this->dataRecord['username_prefix'], $webdavuser_prefix, $global_config['webdavuser_prefix']), true);
 		}
 
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"]);
+			$app->tpl->setVar("parent_domain_id_value", $this->dataRecord["parent_domain_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}
diff --git a/interface/web/vm/openvz_vm_edit.php b/interface/web/vm/openvz_vm_edit.php
@@ -198,8 +198,8 @@ function onShowEnd() {
 		if($this->id > 0) {
 			//* we are editing a existing record
 			$app->tpl->setVar("edit_disabled", 1);
-			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
-			$app->tpl->setVar("ostemplate_id_value", $this->dataRecord["ostemplate_id"]);
+			$app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);
+			$app->tpl->setVar("ostemplate_id_value", $this->dataRecord["ostemplate_id"], true);
 		} else {
 			$app->tpl->setVar("edit_disabled", 0);
 		}

Original file line number	Diff line number	Diff line change
`@@ -287,7 +287,7 @@ function onError() {`
`287`	`287`	`global $app, $conf;`
`288`	`288`
`289`	`289`	`$app->tpl->setVar("error", "<li>".$app->tform->errorMessage."</li>");`
`290`		`- $app->tpl->setVar($this->dataRecord);`
	`290`	`+ $app->tpl->setVar($this->dataRecord, null, true);`
`291`	`291`	`$this->onShow();`
`292`	`292`	`}`
`293`	`293`
Original file line number	Diff line number	Diff line change
`@@ -70,9 +70,9 @@ function onShowEnd() {`
`70`	`70`	`if($this->id > 0){`
`71`	`71`	`if($this->dataRecord['master_directive_snippets_id'] > 0){`
`72`	`72`	`$is_master = true;`
`73`		`- $app->tpl->setVar("name", $this->dataRecord['name']);`
`74`		`- $app->tpl->setVar("type", $this->dataRecord['type']);`
`75`		`- $app->tpl->setVar("snippet", $this->dataRecord['snippet']);`
	`73`	`+ $app->tpl->setVar("name", $this->dataRecord['name'], true);`
	`74`	`+ $app->tpl->setVar("type", $this->dataRecord['type'], true);`
	`75`	`+ $app->tpl->setVar("snippet", $this->dataRecord['snippet'], true);`
`76`	`76`	`}`
`77`	`77`	`}`
`78`	`78`	`$app->tpl->setVar("is_master", $is_master);`
Original file line number	Diff line number	Diff line change
`@@ -149,7 +149,7 @@ function onShowEnd() {`
`149`	`149`	`if($this->id > 0) {`
`150`	`150`	`//* we are editing a existing record`
`151`	`151`	`$app->tpl->setVar("edit_disabled", 1);`
`152`		`- $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);`
	`152`	`+ $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);`
`153`	`153`	`} else {`
`154`	`154`	`$app->tpl->setVar("edit_disabled", 0);`
`155`	`155`	`}`
Original file line number	Diff line number	Diff line change
`@@ -204,7 +204,7 @@ function onShowEnd() {`
`204`	`204`	`if($this->id > 0) {`
`205`	`205`	`//* we are editing a existing record`
`206`	`206`	`$app->tpl->setVar("edit_disabled", 1);`
`207`		`- $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);`
	`207`	`+ $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);`
`208`	`208`	`} else {`
`209`	`209`	`$app->tpl->setVar("edit_disabled", 0);`
`210`	`210`	`}`
Original file line number	Diff line number	Diff line change
`@@ -121,7 +121,7 @@ function onShowEnd() {`
`121`	`121`	`if($this->dataRecord['autoresponder_subject'] == '') {`
`122`	`122`	`$app->tpl->setVar('autoresponder_subject', $app->tform->lng('autoresponder_subject'));`
`123`	`123`	`} else {`
`124`		`- $app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject']);`
	`124`	`+ $app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject'], true);`
`125`	`125`	`}`
`126`	`126`
`127`	`127`	`$app->uses('getconf');`
Original file line number	Diff line number	Diff line change
`@@ -211,7 +211,7 @@ function onShowEnd() {`
`211`	`211`	`if($this->id > 0) {`
`212`	`212`	`//* we are editing a existing record`
`213`	`213`	`$app->tpl->setVar("edit_disabled", 1);`
`214`		`- $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);`
	`214`	`+ $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"], true);`
`215`	`215`	`} else {`
`216`	`216`	`$app->tpl->setVar("edit_disabled", 0);`
`217`	`217`	`}`
Original file line number	Diff line number	Diff line change
`@@ -84,7 +84,7 @@ function onShowEnd() {`
`84`	`84`	`if($this->dataRecord['autoresponder_subject'] == '') {`
`85`	`85`	`$app->tpl->setVar('autoresponder_subject', $app->tform->lng('autoresponder_subject'));`
`86`	`86`	`} else {`
`87`		`- $app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject']);`
	`87`	`+ $app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject'], true);`
`88`	`88`	`}`
`89`	`89`
`90`	`90`	`parent::onShowEnd();`