CVE-2022-3002: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-06T18:16Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: Other
Files changed: layouts/basic/modules/Settings/BusinessHours/EditViewBlocks.tpl
Commit date: 2022-08-26 08:50:48 +0200
Commit message: Improved display of data in the business hours

Diff: diff --git a/layouts/basic/modules/Settings/BusinessHours/EditViewBlocks.tpl b/layouts/basic/modules/Settings/BusinessHours/EditViewBlocks.tpl
index 249ef4aac7e2..aea40d1a2b57 100644
--- a/layouts/basic/modules/Settings/BusinessHours/EditViewBlocks.tpl
+++ b/layouts/basic/modules/Settings/BusinessHours/EditViewBlocks.tpl
@@ -17,22 +17,21 @@
 					</div>
 				</div>
 				<div class="card">
 					<div class="card-header">
 						{if !empty($RECORD_MODEL->getId())}
-							<span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS',$QUALIFIED_MODULE)} - {$RECORD_MODEL->getName()}
+							<span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS',$QUALIFIED_MODULE)} - {\App\Purifier::encodeHtml($RECORD_MODEL->getName())}
 						{else}
 							<span class="fas fa-plus mr-2"></span>{\App\Language::translate('LBL_ADD_BUSINESS_HOURS',$QUALIFIED_MODULE)}
 						{/if}
 					</div>
 					<div class="card-body">
 						<div class="row mb-3">
 							<div class="col-12 form-group row">
 								<label class="col-5"><span class="redColor">*</span>{\App\Language::translate('LBL_NAME', $QUALIFIED_MODULE)}</label>
 								<div class="col-7">
-									<input type="text" name="name" class="form-control w-100" {if isset($RECORD_MODEL)} value="{$RECORD_MODEL->getName()}" {/if}
-										data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]">
+									<input type="text" name="name" class="form-control w-100" {if isset($RECORD_MODEL)}value="{\App\Purifier::encodeHtml($RECORD_MODEL->getName())}" {/if} data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]">
 								</div>
 							</div>
 							<div class="col-12 form-group row">
 								<label class="col-5">{\App\Language::translate('LBL_WORKING_DAYS', $QUALIFIED_MODULE)}</label>
 								<div class="col-7">

Vulnerable code: 							<span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS',$QUALIFIED_MODULE)} - {$RECORD_MODEL->getName()}
									<input type="text" name="name" class="form-control w-100" {if isset($RECORD_MODEL)} value="{$RECORD_MODEL->getName()}" {/if}
										data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]">
Fixed code: 							<span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS',$QUALIFIED_MODULE)} - {\App\Purifier::encodeHtml($RECORD_MODEL->getName())}
									<input type="text" name="name" class="form-control w-100" {if isset($RECORD_MODEL)}value="{\App\Purifier::encodeHtml($RECORD_MODEL->getName())}" {/if} data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]">