CVE-2022-2924: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-20T06:15Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: Other
Files changed: config/version.php, layouts/basic/modules/Vtiger/dashboards/Calendar.tpl, layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl, layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl, layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl, layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl, layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl, layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl, layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl, layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl, layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl, layouts/basic/modules/Vtiger/dashboards/MailsList.tpl, layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl, layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl, layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl, layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl
Commit date: 2022-08-22 07:18:59 +0200
Commit message: Improved data display on some widgets

Diff: diff --git a/config/version.php b/config/version.php
index 5f2123c04342..0b20984d6bbf 100644
--- a/config/version.php
+++ b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.4.0',
-	'patchVersion' => '2022.08.19',
+	'appVersion' => '6.4.1',
+	'patchVersion' => '2022.08.22',
 	'lib_roundcube' => '0.3.0',
 ];
diff --git a/layouts/basic/modules/Vtiger/dashboards/Calendar.tpl b/layouts/basic/modules/Vtiger/dashboards/Calendar.tpl
index d0bbeeebdbd6..e5be6fdd2b7d 100644
--- a/layouts/basic/modules/Vtiger/dashboards/Calendar.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/Calendar.tpl
@@ -58,11 +58,11 @@
 									data-off-text="{\App\Language::translate('History')}" autocomplete="
 							   off"> {\App\Language::translate('History')}
 							</label>
 						</div>
 						<input type="hidden" value="current" data-current="{implode('##',$CURRENT_STATUS)}"
-							data-history="{implode(',',$HISTORY_STATUS)}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']}" {/if}>
+							data-history="{implode(',',$HISTORY_STATUS)|escape}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']|escape}" {/if}>
 					{/if}
 				</div>
 				<div class="col-ceq-xsm-6">
 					{include file=\App\Layout::getTemplatePath('dashboards/SelectAccessibleTemplate.tpl', $MODULE_NAME)}
 				</div>
diff --git a/layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl b/layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl
index 40e1e3723b2e..5f8db6aae7ac 100644
--- a/layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl
@@ -15,11 +15,11 @@
 			font-size: 75%;
 		}
 	</style>
 	<div>
 		{foreach from=$ACTIVITIES key=INDEX item=ACTIVITY}
-			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()}" accesskey="">
+			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()|escape}" accesskey="">
 				<div class="rowActivities">
 					<div class="d-flex mb-1">
 						<div class="">
 							{assign var=ACTIVITY_TYPE value=$ACTIVITY->get('activitytype')}
 							{assign var=ACTIVITY_UPPERCASE value=$ACTIVITY_TYPE|upper}
@@ -45,11 +45,11 @@
 						{assign var=SUBPROCESS value=$ACTIVITY->get('subprocess')}
 						{assign var=CONTRACTOR value=$ACTIVITY->get('contractor')}
 						<div class="w-100 mx-1">
 							{\App\TextUtils::textTruncate($ACTIVITY->getDisplayName(), $NAMELENGTH)}
 							{if $CONTRACTOR}
-								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
+								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()|escape}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
 							{/if}
 							{if $LINK}
 								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('link')}</strong></small>
 							{/if}
 							{if $PROCESS}
@@ -82,11 +82,11 @@
 				{\App\Language::translate($NODATAMSGLABLE, $MODULE_NAME)}
 			</span>
 		{/foreach}
 		{if $PAGING_MODEL->get('nextPageExists') eq 'true'}
 			<div class="float-right padding5">
-				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()}&page={$PAGING_MODEL->getNextPage()}">
+				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()|escape}&page={$PAGING_MODEL->getNextPage()}">
 					{\App\Language::translate('LBL_MORE')}
 				</button>
 			</div>
 		{/if}
 	</div>
diff --git a/layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl b/layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl
index 6fbc8d3e081d..0680eae0fc3e 100644
--- a/layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl
@@ -1,8 +1,8 @@
 {*<!-- {[The file is published on the basis of YetiForce Public License 5.0 that can be found in the following directory: licenses/LicenseEN.txt or yetiforce.com]} -->*}
 {strip}
 	<input type="hidden" id="currentView" value="{$VIEW}" />
-	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')}" />
-	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')}" />
+	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')|escape}" />
+	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')|escape}" />
 	<input type="hidden" id="defaultDate" value="{$DEFAULTDATE}" />
 	<div class="js-calendar__container" data-js="fullcalendar"></div>
 {/strip}
diff --git a/layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl b/layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl
index 91ce2a805424..4125045e40d8 100644
--- a/layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl
@@ -13,11 +13,11 @@
 				<div class="container-fluid pt-3">
 					<input type="hidden" id="widgetStep" value="" />
 					<div>
 						<div class="form-group row mb-2">
 							<label class="{$COL_LBL}">{\App\Language::translate('LBL_WIDGET_NAME','Home')}</label>
-							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{$WIDGET_MODEL->getValueForEditView('title')}"></div>
+							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"></div>
 						</div>
 						<div class="form-group row mb-2">
 							<label class="{$COL_LBL}"><span class="redColor">*</span>{\App\Language::translate('LBL_SELECT_CHART','Home')}</label>
 							<div class="{$COL_CTRL}">
 								{assign "VALUE_CHART_TYPE" $WIDGET_MODEL->getValueForEditView('chartType')}
@@ -57,11 +57,11 @@
 		<div class="form-group row mb-2">
 			<label class="{$COL_LBL}"><span class="redColor">*</span>{\App\Language::translate('LBL_FILTER')}</label>
 			<div class="{$COL_CTRL}">
 				{assign "VALUE_FILTER" $WIDGET_MODEL->getValueForEditView('filterid')}
 				<select class="form-control filtersId" {if $CHART_TYPE!=='Funnel' && $CHART_TYPE!=='Table' }name="filtersId"
-					multiple="multiple" {else}name="filtersId[]" 
+					multiple="multiple" {else}name="filtersId[]"
 					{/if}
 					data-validation-engine="validate[required]" data-maximum-selection-length="{\App\Config::performance('CHART_MULTI_FILTER_LIMIT')}">
 					<option></option>
 					{foreach from=$ALLFILTERS item=FILTERS key=FILTERGROUP}
 						<optgroup label="{\App\Language::translate($FILTERGROUP,$SELECTED_MODULE)}">
diff --git a/layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl b/layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl
index 10dea8349a20..9b91f91cbe00 100644
--- a/layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl
@@ -40,11 +40,11 @@
 								{foreach from=$HEADERS item=HEADER}
 									<td class="text-center noWrap listButtons narrow">
 										{if $IS_SUMMARY} {$SUMMARY[$HEADER][] = $CHART_DATA.$HEADER.$GROUP_HEADER.$VALUE_TYPE} {/if}
 										{assign var=VALUE value=$CHART_MODEL->convertToUserFormat($CHART_DATA.$HEADER.$GROUP_HEADER.$VALUE_TYPE)}
 										{if !empty($CHART_DATA.$HEADER.$GROUP_HEADER.link)}
-											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link}">{$VALUE}</a>
+											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link|escape}">{$VALUE}</a>
 										{else}
 											{$VALUE}
 										{/if}
 									</td>
 								{/foreach}
diff --git a/layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl b/layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl
index 4b619a9c6dd1..c626856053ee 100644
--- a/layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl
@@ -42,12 +42,12 @@
 					gs-y="{$WIDGET->getPosition($ROW, 'row')}" gs-x="{$WIDGET->getPosition($COLCOUNT, 'col')}"
 					gs-w="{$WIDGET->getWidth()}" gs-h="{$WIDGET->getHeight()}"
 					data-js="css-element-queries">
 					<div id="{$WIDGETDOMID}" {if $smarty.foreach.count.index % $COLUMNS == 0 and $smarty.foreach.count.index != 0} {/if}
 						class="grid-stack-item-content dashboardWidget dashboardWidget_{$smarty.foreach.count.index}"
-						data-url="{$WIDGET->getUrl()}"
-						data-mode="open" data-name="{$WIDGET->getName()}" data-cache="{$WIDGET->get('cache')}"
+						data-url="{$WIDGET->getUrl()|escape}"
+						data-mode="open" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-cache="{$WIDGET->get('cache')|escape}"
 						data-loader="widgetLoader">
 					</div>
 				</div>
 			{/foreach}
 			<div class="alert alert-info {if count($WIDGETS) > 0} d-none {/if} js-dashboards-alert" role="alert" data-js=”container”>
diff --git a/layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl b/layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl
index 220bf4f3c819..b0703855a6da 100644
--- a/layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl
@@ -14,15 +14,15 @@
 		</ul>
 		{if $MODULES_WITH_WIDGET}
 			{assign var=COUNT value=count($MODULES_WITH_WIDGET)}
 			<ul class="nav nav-inverted-tabs massEditTabs selectDashboradView ml-sm-2">
 				{foreach from=$MODULES_WITH_WIDGET item=MODULE_WIDGET}
-					<li class="nav-item" data-module="{$MODULE_WIDGET}">
+					<li class="nav-item" data-module="{$MODULE_WIDGET|escape}">
 						<a class="nav-link pt-1 pb-1 {if $MODULE_NAME eq $MODULE_WIDGET} active {/if}{if $COUNT === 1} d-none{/if}"
 							href="#"
 							data-toggle="tab">
-							<span class="yfm-{$MODULE_WIDGET} mx-1"></span>
+							<span class="yfm-{$MODULE_WIDGET|escape} mx-1"></span>
 							{\App\Language::translate($MODULE_WIDGET, $MODULE_WIDGET)}
 						</a>
 					</li>
 				{/foreach}
 			</ul>
diff --git a/layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl b/layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl
index bbfd8506ffcb..cf5c667a59fc 100644
--- a/layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl
@@ -10,12 +10,12 @@
 		<span class="d-none d-md-inline">{\App\Language::translate('LBL_PREDEFINED_WIDGETS','Dashboard')}</span>
 	</button>
 	<div class="js-widget-list dropdown-menu widgetsList addWidgetDropDown" data-js="container">
 		{assign var="WIDGET" value=""}
 		{foreach from=$WIDGETS item=WIDGET}
-			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{$WIDGET->getName()}" data-id="{$WIDGET->get('widgetid')}"
-				data-widget-url="{$WIDGET->getUrl()}" data-linkid="{$WIDGET->get('linkid')}"
+			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-id="{$WIDGET->get('widgetid')}"
+				data-widget-url="{$WIDGET->getUrl()|escape}" data-linkid="{$WIDGET->get('linkid')}"
 				data-width="{$WIDGET->getWidth()}" data-height="{$WIDGET->getHeight()}" data-js="remove | click">
 				{\App\Language::translate($WIDGET->getTitle(), $MODULE_NAME, null, true, 'Dashboard')}
 				{if $WIDGET->isDeletable()}
 					<span class="text-danger pl-5 ml-auto">
 						<span class="fas fa-trash-alt removeWidgetFromList u-hover-opacity" data-widget-id="{$WIDGET->get('widgetid')}" data-js="click"></span>
diff --git a/layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl b/layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl
index 24032a7a00b4..696d9c541620 100644
--- a/layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl
@@ -14,14 +14,14 @@
 		<a class="btn btn-sm btn-light" name="dfilter">
 			<span class='icon-cog' title="{\App\Language::translate('LBL_FILTER')}"></span>
 		</a>
 		&nbsp;
 	{/if}
-	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
+	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
 		<span class="fas fa-sync-alt"></span>
 	</button>
 	{if !$WIDGET->isDefault()}
-		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
+		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
 			<span class="fas fa-times"></span>
 		</button>
 	{/if}
 {/strip}
diff --git a/layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl b/layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl
index d4349b1add93..1ade31568218 100644
--- a/layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl
@@ -20,11 +20,11 @@
 				{/foreach}
 			</tr>
 			{foreach key=$index item=record from=$LIST}
 				<tr>
 					{foreach from=$record item=item key=key}
-						<td>{$item}</td>
+						<td>{\App\Purifier::encodeHtml($item)}</td>
 					{/foreach}
 				</tr>
 			{/foreach}
 		</table>
 	{else}
diff --git a/layouts/basic/modules/Vtiger/dashboards/MailsList.tpl b/layouts/basic/modules/Vtiger/dashboards/MailsList.tpl
index 8f32c52f5813..f875729b6fb5 100644
--- a/layouts/basic/modules/Vtiger/dashboards/MailsList.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/MailsList.tpl
@@ -8,15 +8,15 @@
 			<script type="{$jsModel->getType()}" src="{$jsModel->getSrc()}"></script>
 		{/foreach}
 		<div class="d-flex flex-row flex-nowrap no-gutters justify-content-between">
 			{include file=\App\Layout::getTemplatePath('dashboards/WidgetHeaderTitle.tpl', $MODULE_NAME)}
 			<div class="d-inline-flex">
-				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
+				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
 					<span class="fas fa-sync-alt"></span>
 				</button>
 				{if !$WIDGET->isDefault()}
-					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
+					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
 						<span class="fas fa-times"></span>
 					</button>
 				{/if}
 			</div>
 		</div>
@@ -32,11 +32,11 @@
 					<select class="form-control select2noactive widgetFilter" name="mailAccount" aria-describedby="inputGroup-sizing-sm" id="mailUserList" title="{\App\Language::translate('LBL_MAIL_USERS_LIST')}">
 						{if count($ACCOUNTSLIST) eq 0}
 							<option value="-">{\App\Language::translate('--None--', $MODULE_NAME)}</option>
 						{else}
 							{foreach from=$ACCOUNTSLIST item=item key=key}
-								<option title="{$item['username']}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{$item['username']}</option>
+								<option title="{\App\Purifier::encodeHtml($item['username'])}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{\App\Purifier::encodeHtml($item['username'])}</option>
 							{/foreach}
 						{/if}
 					</select>
 				</div>
 			</div>
diff --git a/layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl b/layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl
index a2461a301ce9..a12d2bba1695 100644
--- a/layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl
@@ -32,11 +32,11 @@
 								<tbody>
 									<tr>
 										<td class="fieldLabel alignMiddle textAlignCenter"
 											nowrap>{App\Language::translate('LBL_WIDGET_NAME','Home')}</td>
 										<td class="fieldValue position-relative">
-											<input type="text" class="form-control" name="widgetTitle" value="{$WIDGET_MODEL->getValueForEditView('title')}"
+											<input type="text" class="form-control" name="widgetTitle" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"
 												data-validation-engine="validate[required]" {if $WIDGET_ID} disabled{/if}>
 										</td>
 									</tr>
 									<tr>
 										<td class="fieldLabel alignMiddle textAlignCenter"
@@ -44,11 +44,11 @@
 										<td class="fieldValue">
 											{assign "VALUE_FIELD" $WIDGET_MODEL->getValueForEditView('module')}
 											<select class="form-control select2" name="module" {if $WIDGET_ID} disabled{/if}>
 												<option></option>
 												{foreach from=$MODULES item=MODULE_MODEL key=MODULE_THIS_NAME}
-													<option value="{$MODULE_MODEL['name']}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
+													<option value="{$MODULE_MODEL['name']|escape}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
 												{/foreach}
 											</select>
 										</td>
 									</tr>
 									<tr>
@@ -150,11 +150,11 @@
 	{elseif $WIZARD_STEP eq 'step3'}
 		<div>
 			<select class="form-control" name="fields" size="2" multiple="true">
 				<option></option>
 				{foreach from=$LIST_VIEW_FIELDS item=FIELD key=FIELD_NAME}
-					<option value="{$FIELD_NAME}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
+					<option value="{$FIELD_NAME|escape}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
 				{/foreach}
 			</select>
 			<select class="form-control" name="filter_fields">
 				<option></option>
 				{foreach from=$FIELDS_BY_BLOCK item=FIELDS key=BLOCK_NAME}
diff --git a/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl b/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl
index 21c4ecac9838..a5741f06ff9d 100644
--- a/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl
@@ -31,11 +31,11 @@
 				</select>
 			</div>
 			<div class="col-ceq-xsm-6">
 				<div class="float-right">
 					<button class="btn btn-light btn-sm ml-1 goToListView"
-						data-url="{$WIDGET_MODEL->getUrl()}"
+						data-url="{$WIDGET_MODEL->getUrl()|escape}"
 						title="{\App\Language::translate('LBL_GO_TO_RECORDS_LIST', $MODULE_NAME)}">
 						<span class="fas fa-th-list"></span>
 					</button>
 				</div>
 			</div>
diff --git a/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl b/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl
index 1968166778bd..64ed55b2cc7f 100644
--- a/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl
@@ -26,11 +26,11 @@
 			{/foreach}
 		</div>
 	{/foreach}
 	{if count($WIDGET_RECORDS) >= $WIDGET_MODEL->getRecordLimit()}
 		<button class="btn btn-light float-right btn-sm goToListView"
-			data-url="{$WIDGET_MODEL->getUrl()}"
+			data-url="{$WIDGET_MODEL->getUrl()|escape}"
 			title="{\App\Language::translate('LBL_MORE', $MODULE_NAME)}">
 			<span>{\App\Language::translate('LBL_MORE', $MODULE_NAME)}</span>
 		</button>
 	{/if}
 	<!-- /tpl-Base-Dashboards-ProductsSoldToRenewContents -->
diff --git a/layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl b/layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl
index d9b269ff3a4d..254ecbbff0a1 100644
--- a/layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl
+++ b/layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl
@@ -36,15 +36,15 @@
 					{assign var=AJAX_URL value=$AJAX_URL|cat:"&result[]=groups"}
 				{/if}
 				{if in_array('users', $ACCESS_OPTIONS['available'])}
 					{assign var=AJAX_URL value=$AJAX_URL|cat:"&result[]=users"}
 				{/if}
-				data-ajax-search="1" data-ajax-url="{$AJAX_URL}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
+				data-ajax-search="1" data-ajax-url="{$AJAX_URL|escape}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
 			{/if}>
 
 			{if in_array('mine', $ACCESS_OPTIONS.available)}
-				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()}"
+				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()|escape}"
 					title="{\App\Language::translate('LBL_MINE')}" {if $OWNER eq $USER_MODEL->getId()} selected {/if}>{\App\Language::translate('LBL_MINE')}</option>
 			{/if}
 			{if in_array('all', $ACCESS_OPTIONS.available)}
 				<option value="all" {if $OWNER eq 'all' || $ACCESS_OPTIONS['default'] eq 'all'} data-name="" title="{\App\Language::translate('LBL_ALL')}" selected {/if}>{\App\Language::translate('LBL_ALL')}</option>
 			{/if}

Vulnerable code: 	'appVersion' => '6.4.0',
	'patchVersion' => '2022.08.19',
							data-history="{implode(',',$HISTORY_STATUS)}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']}" {/if}>
			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()}" accesskey="">
								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()}&page={$PAGING_MODEL->getNextPage()}">
	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')}" />
	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')}" />
							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{$WIDGET_MODEL->getValueForEditView('title')}"></div>
					multiple="multiple" {else}name="filtersId[]" 
											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link}">{$VALUE}</a>
						data-url="{$WIDGET->getUrl()}"
						data-mode="open" data-name="{$WIDGET->getName()}" data-cache="{$WIDGET->get('cache')}"
					<li class="nav-item" data-module="{$MODULE_WIDGET}">
							<span class="yfm-{$MODULE_WIDGET} mx-1"></span>
			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{$WIDGET->getName()}" data-id="{$WIDGET->get('widgetid')}"
				data-widget-url="{$WIDGET->getUrl()}" data-linkid="{$WIDGET->get('linkid')}"
	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
						<td>{$item}</td>
				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
								<option title="{$item['username']}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{$item['username']}</option>
											<input type="text" class="form-control" name="widgetTitle" value="{$WIDGET_MODEL->getValueForEditView('title')}"
													<option value="{$MODULE_MODEL['name']}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
					<option value="{$FIELD_NAME}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
						data-url="{$WIDGET_MODEL->getUrl()}"
			data-url="{$WIDGET_MODEL->getUrl()}"
				data-ajax-search="1" data-ajax-url="{$AJAX_URL}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()}"
Fixed code: 	'appVersion' => '6.4.1',
	'patchVersion' => '2022.08.22',
							data-history="{implode(',',$HISTORY_STATUS)|escape}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']|escape}" {/if}>
			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()|escape}" accesskey="">
								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()|escape}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()|escape}&page={$PAGING_MODEL->getNextPage()}">
	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')|escape}" />
	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')|escape}" />
							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"></div>
					multiple="multiple" {else}name="filtersId[]"
											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link|escape}">{$VALUE}</a>
						data-url="{$WIDGET->getUrl()|escape}"
						data-mode="open" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-cache="{$WIDGET->get('cache')|escape}"
					<li class="nav-item" data-module="{$MODULE_WIDGET|escape}">
							<span class="yfm-{$MODULE_WIDGET|escape} mx-1"></span>
			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-id="{$WIDGET->get('widgetid')}"
				data-widget-url="{$WIDGET->getUrl()|escape}" data-linkid="{$WIDGET->get('linkid')}"
	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
						<td>{\App\Purifier::encodeHtml($item)}</td>
				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
								<option title="{\App\Purifier::encodeHtml($item['username'])}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{\App\Purifier::encodeHtml($item['username'])}</option>
											<input type="text" class="form-control" name="widgetTitle" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"
													<option value="{$MODULE_MODEL['name']|escape}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
					<option value="{$FIELD_NAME|escape}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
						data-url="{$WIDGET_MODEL->getUrl()|escape}"
			data-url="{$WIDGET_MODEL->getUrl()|escape}"
				data-ajax-search="1" data-ajax-url="{$AJAX_URL|escape}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()|escape}"