CVE-2014-3840: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-05-27T13:55Z
Repository: https://github.com/mayan-edms/mayan-edms
Language: HTML
Files changed: apps/common/templates/calculate_form_title.html, apps/common/templates/generic_detail.html, apps/common/templates/generic_form.html, apps/common/templates/generic_list.html, apps/common/templates/generic_list_horizontal.html, apps/common/templates/generic_list_subtemplate.html
Commit date: 2014-05-22 17:27:06 -0400
Commit message: Remove the striptags functionality, fixes some instances of XSS, issue #3

Diff: diff --git a/apps/common/templates/calculate_form_title.html b/apps/common/templates/calculate_form_title.html
index 2994f1d3..adaec981 100644
--- a/apps/common/templates/calculate_form_title.html
+++ b/apps/common/templates/calculate_form_title.html
@@ -1,30 +1,26 @@
 {% load i18n %}
 {% if title %}
-    {% if striptags %}
-        {{ title|capfirst|striptags }}
-    {% else %}
-        {{ title|capfirst|safe }}
-    {% endif %}
+    {{ title|capfirst }}
 {% else %}
     {% if read_only %}
         {% if object_name %}
             {% blocktrans %}Details for {{ object_name }}: {{ object }}{% endblocktrans %}
         {% else %}
             {% blocktrans %}Details for: {{ object }}{% endblocktrans %}
         {% endif %}
     {% else %}
         {% if object %}
             {% if object_name %}
-                {% blocktrans %}Edit {{ object_name }}:{% endblocktrans %} {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
+                {% blocktrans with object as object and object_name as object_name %}Edit {{ object_name }}: {{ object }}{% endblocktrans %}
             {% else %}
-                {% trans "Edit" %}: {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
+                {% blocktrans with object as object %}Edit: {{ object }}{% endblocktrans %}
             {% endif %}
         {% else %}
             {% if object_name %}
                 {% blocktrans %}Create new {{ object_name }}{% endblocktrans %}
             {% else %}
                 {% trans "Create" %}
             {% endif %}
-        {% endif %}                
+        {% endif %}
     {% endif %}
 {% endif %}
diff --git a/apps/common/templates/generic_detail.html b/apps/common/templates/generic_detail.html
index c5cc9789..e7f0dac7 100644
--- a/apps/common/templates/generic_detail.html
+++ b/apps/common/templates/generic_detail.html
@@ -1,18 +1,18 @@
 {% extends "base.html" %}
 {% load i18n %}
 {% load subtemplates_tags %}
 
-{% block title %} :: {% with "true" as read_only %}{% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endwith %}{% endblock %}
+{% block title %} :: {% with "true" as read_only %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
 
 {% block sidebar %}
     {% for subtemplate in sidebar_subtemplates %}
         <div class="generic_subform">
             {% include subtemplate %}
-        </div>        
+        </div>
     {% endfor %}
-  
+
     {% for subtemplate in sidebar_subtemplates_list %}
         {% with "true" as side_bar %}
             {% if subtemplate.form %}
                 {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
                 {% with "true" as read_only %}
@@ -24,22 +24,22 @@
                 {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
                 {{ rendered_subtemplate }}
             {% endif %}
                 </div>
                 {% if subtemplate.grid_clear or not subtemplate.grid %}
-                    <div class=""></div> 
+                    <div class=""></div>
             {% endif %}
         {% endwith %}
-    {% endfor %}     
+    {% endfor %}
 {% endblock %}
 
 {% block stylesheets %}
     <style type="text/css">
-        #subform form  textarea, 
+        #subform form  textarea,
         #subform form  select option,
-        #subform form  input, 
-        #subform form  select, 
+        #subform form  input,
+        #subform form  select,
         #subform form  input { background: none; color: black; border: none; }
     </style>
 {% endblock %}
 
 {% block content %}
@@ -49,28 +49,28 @@
                 <div class="generic_subform">
                     {% include "generic_form_subtemplate.html" %}
                 </div>
             </div>
             {% if grid_clear or not grid %}
-                <div class=""></div> 
+                <div class=""></div>
             {% endif %}
         {% endwith %}
     {% endif %}
-    
+
     <div class="container_12">
         {% for subtemplate in subtemplates_list %}
-            <div class="grid_{{ subtemplate.grid|default:12 }}">       
+            <div class="grid_{{ subtemplate.grid|default:12 }}">
                 {% with "true" as read_only %}
                     {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
                     <div class="generic_subform">
                         {{ rendered_subtemplate }}
                     </div>
                 {% endwith %}
             </div>
             {% if subtemplate.grid_clear or not subtemplate.grid %}
-                <div class="clear"></div> 
+                <div class="clear"></div>
             {% endif %}
          {% endfor %}
-    </div>    
-    
+    </div>
+
 {% endblock %}
 
diff --git a/apps/common/templates/generic_form.html b/apps/common/templates/generic_form.html
index f78216e9..5fedec55 100644
--- a/apps/common/templates/generic_form.html
+++ b/apps/common/templates/generic_form.html
@@ -1,9 +1,9 @@
 {% extends "base.html" %}
 {% load subtemplates_tags %}
 
-{% block title %} :: {% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
+{% block title %} :: {% include "calculate_form_title.html" %}{% endblock %}
 
 {% block sidebar %}
     {% for subtemplate in sidebar_subtemplates_list %}
         {% if subtemplate.form %}
             {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
@@ -23,14 +23,14 @@
     {% if form %}
         <div class="generic_subform">
             {% include "generic_form_subtemplate.html" %}
         </div>
     {% endif %}
-                             
+
 <div class="container_12">
     {% for subtemplate in subtemplates_list %}
-        <div class="grid_{{ subtemplate.grid|default:12 }}">       
+        <div class="grid_{{ subtemplate.grid|default:12 }}">
             {% if subtemplate.form %}
                 {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
                     <div class="generic_subform">
                         {{ rendered_subtemplate }}
                     </div>
@@ -38,10 +38,10 @@
                 {% render_subtemplate subtemplate.name subtemplate.context as rendered_subtemplate %}
                 {{ rendered_subtemplate }}
             {% endif %}
         </div>
         {% if subtemplate.grid_clear or not subtemplate.grid %}
-            <div class="clear"></div> 
+            <div class="clear"></div>
         {% endif %}
      {% endfor %}
 </div>
 {% endblock %}
diff --git a/apps/common/templates/generic_list.html b/apps/common/templates/generic_list.html
index 19e7a34b..d1fb13ac 100644
--- a/apps/common/templates/generic_list.html
+++ b/apps/common/templates/generic_list.html
@@ -1,11 +1,11 @@
 {% extends "base.html" %}
 {% load i18n %}
 {% load navigation_tags %}
 {% load subtemplates_tags %}
 
-{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
+{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
 {#{% block secondary_links %}{{ secondary_links|safe }}{% endblock %}#}
 
 {% block sidebar %}
     {% for subtemplate in sidebar_subtemplates_list %}
         {% if subtemplate.form %}
diff --git a/apps/common/templates/generic_list_horizontal.html b/apps/common/templates/generic_list_horizontal.html
index c70d5299..39915c8e 100644
--- a/apps/common/templates/generic_list_horizontal.html
+++ b/apps/common/templates/generic_list_horizontal.html
@@ -1,11 +1,11 @@
 {% extends "base.html" %}
 {% load i18n %}
 {% load navigation_tags %}
 {% load subtemplates_tags %}
 
-{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
+{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
 {#{% block secondary_links %}{{ secondary_links|safe }}{% endblock %}#}
 
 {% block sidebar %}
     {% for subtemplate in sidebar_subtemplates_list %}
         {% if subtemplate.form %}
diff --git a/apps/common/templates/generic_list_subtemplate.html b/apps/common/templates/generic_list_subtemplate.html
index 81dfa739..6d826f3f 100644
--- a/apps/common/templates/generic_list_subtemplate.html
+++ b/apps/common/templates/generic_list_subtemplate.html
@@ -14,12 +14,12 @@
     <h3>
         {{ title|capfirst }}
     </h3>
     <div class="content">
         <p>
-{% else %}    
-    {% autopaginate object_list %} 
+{% else %}
+    {% autopaginate object_list %}
     <div class="content">
     <h2 class="title">
         {% ifnotequal page_obj.paginator.num_pages 1 %}
             {% blocktrans with page_obj.start_index as start and page_obj.end_index as end and page_obj.paginator.object_list|length as total and page_obj.number as page_number and page_obj.paginator.num_pages as total_pages %}List of {{ title }} ({{ start }} - {{ end }} out of {{ total }}) (Page {{ page_number }} of {{ total_pages }}){% endblocktrans %}
         {% else %}
@@ -51,13 +51,13 @@
                             <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                 <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                             </button>
                         </div>
                     {% endif %}
-                {% endif %}          
-            {% endif %}          
-        
+                {% endif %}
+            {% endif %}
+
             {% if scrollable_content %}
                 <div style="border: 1px solid; height: {{ scrollable_content_height }}; overflow: auto;">
             {% endif %}
 
             <table class="table">
@@ -76,24 +76,24 @@
                                 <th>{{ column.name|capfirst }}</th>
                             {% endfor %}
 
                             {% for column in object_list.0|get_model_list_columns %}
                                 <th>{{ column.name|capfirst }}</th>
-                            {% endfor %}            
+                            {% endfor %}
 
                             {% for column in extra_columns %}
                                 <th>{{ column.name|capfirst }}</th>
-                            {% endfor %}        
+                            {% endfor %}
 
                             {% if not hide_links %}
                                 <th class="">&nbsp;</th>
                             {% endif %}
                         </tr>
                     {% endif %}
                     {% for object in object_list %}
                         <tr class="{% cycle 'odd' 'even2' %}">
-                        {% if multi_select or multi_select_as_buttons %}    
+                        {% if multi_select or multi_select_as_buttons %}
                             <td>
                             {% if multi_select_item_properties %}
                                 <input type="checkbox" class="checkbox" name="properties_{{ object|get_encoded_parameter:multi_select_item_properties }}" value="" />
                             {% else %}
                                 <input type="checkbox" class="checkbox" name="pk_{{ object.pk }}" value="" />
@@ -115,11 +115,11 @@
                                     {{ object|object_property:column.attribute|make_non_breakable }}
                                 </td>
                             {% else %}
                                 <td>{{ object|object_property:column.attribute }}</td>
                             {% endif %}
-                        {% endfor %}                        
+                        {% endfor %}
                         {% if not hide_columns %}
                             {% for column in object|get_model_list_columns %}
                                 <td>{{ object|object_property:column.attribute }}</td>
                             {% endfor %}
                         {% endif %}
@@ -147,19 +147,19 @@
                                     {% endif %}
                                 </td>
                             {% endif %}
                         </tr>
                     {% empty %}
-                        <tr><td colspan=99 class="tc">{% blocktrans with title|striptags as stripped_title %}There are no {{ stripped_title }}{% endblocktrans %}</td></tr>
+                        <tr><td colspan=99 class="tc">{% blocktrans with title as title %}There are no {{ title }}{% endblocktrans %}</td></tr>
                     {% endfor %}
                 </tbody>
             </table>
-            
+
             {% if scrollable_content %}
-                </div>            
-            {% endif %}            
-            
+                </div>
+            {% endif %}
+
             {% if object_list %}
                 {% if multi_select or multi_select_as_buttons %}
                     {% if multi_select_as_buttons %}
                         {% get_multi_item_links as multi_item_links %}
                         <div class="group navform wat-cf" style="margin-bottom: 0px;">
@@ -177,15 +177,15 @@
                             <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                 <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                             </button>
                         </div>
                     {% endif %}
-                {% endif %}  
-            {% endif %}  
+                {% endif %}
+            {% endif %}
         </form>
         {% paginate %}
-        
+
         {% if side_bar %}
             </p>
-        {% endif %} 
+        {% endif %}
     </div>
 </div>

Vulnerable code:     {% if striptags %}
        {{ title|capfirst|striptags }}
    {% else %}
        {{ title|capfirst|safe }}
    {% endif %}
                {% blocktrans %}Edit {{ object_name }}:{% endblocktrans %} {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
                {% trans "Edit" %}: {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
        {% endif %}                
{% block title %} :: {% with "true" as read_only %}{% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endwith %}{% endblock %}
        </div>        
  
                    <div class=""></div> 
    {% endfor %}     
        #subform form  textarea, 
        #subform form  input, 
        #subform form  select, 
                <div class=""></div> 
    
            <div class="grid_{{ subtemplate.grid|default:12 }}">       
                <div class="clear"></div> 
    </div>    
    
{% block title %} :: {% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
                             
        <div class="grid_{{ subtemplate.grid|default:12 }}">       
            <div class="clear"></div> 
{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
{% else %}    
    {% autopaginate object_list %} 
                {% endif %}          
            {% endif %}          
        
                            {% endfor %}            
                            {% endfor %}        
                        {% if multi_select or multi_select_as_buttons %}    
                        {% endfor %}                        
                        <tr><td colspan=99 class="tc">{% blocktrans with title|striptags as stripped_title %}There are no {{ stripped_title }}{% endblocktrans %}</td></tr>
            
                </div>            
            {% endif %}            
            
                {% endif %}  
            {% endif %}  
        
        {% endif %} 
Fixed code:     {{ title|capfirst }}
                {% blocktrans with object as object and object_name as object_name %}Edit {{ object_name }}: {{ object }}{% endblocktrans %}
                {% blocktrans with object as object %}Edit: {{ object }}{% endblocktrans %}
        {% endif %}
{% block title %} :: {% with "true" as read_only %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
        </div>

                    <div class=""></div>
    {% endfor %}
        #subform form  textarea,
        #subform form  input,
        #subform form  select,
                <div class=""></div>

            <div class="grid_{{ subtemplate.grid|default:12 }}">
                <div class="clear"></div>
    </div>

{% block title %} :: {% include "calculate_form_title.html" %}{% endblock %}

        <div class="grid_{{ subtemplate.grid|default:12 }}">
            <div class="clear"></div>
{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
{% else %}
    {% autopaginate object_list %}
                {% endif %}
            {% endif %}

                            {% endfor %}
                            {% endfor %}
                        {% if multi_select or multi_select_as_buttons %}
                        {% endfor %}
                        <tr><td colspan=99 class="tc">{% blocktrans with title as title %}There are no {{ title }}{% endblocktrans %}</td></tr>

                </div>
            {% endif %}

                {% endif %}
            {% endif %}

        {% endif %}