CVE-2021-4179: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-28T09:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/lib/core/lhchat/lhchatworkflow.php, lhc_web/modules/lhchat/addmsgadmin.php, lhc_web/modules/lhchat/module.php, lhc_web/modules/lhrestapi/addmsgadmin.php
Commit date: 2021-12-27 03:47:03 -0500
Commit message: Separate permission to use [html] code

Diff: diff --git a/lhc_web/lib/core/lhchat/lhchatworkflow.php b/lhc_web/lib/core/lhchat/lhchatworkflow.php
index 35055f4b4f..62f2878709 100644
--- a/lhc_web/lib/core/lhchat/lhchatworkflow.php
+++ b/lhc_web/lib/core/lhchat/lhchatworkflow.php
@@ -873,10 +873,16 @@ class erLhcoreClassChatWorkflow {
 
             $cannedMsg->setReplaceData($replaceArray);
 
             $msg = new erLhcoreClassModelmsg();
             $msg->msg = $cannedMsg->msg_to_user;
+
+            if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassUser::instance()->hasAccessTo('lhchat','htmlbbcodeenabled')) {
+                $msg->msg = '[html] is disabled for you!';
+                $msg->user_id = -1;
+            }
+
             $msg->chat_id = $chat->id;
             $msg->user_id = $chat->user_id;
             $msg->name_support = $chat->user->name_support;
 
             $chat->last_op_msg_time = $chat->last_user_msg_time = $msg->time = time();
diff --git a/lhc_web/modules/lhchat/addmsgadmin.php b/lhc_web/modules/lhchat/addmsgadmin.php
index a467bc0723..4c0b0cbce0 100644
--- a/lhc_web/modules/lhchat/addmsgadmin.php
+++ b/lhc_web/modules/lhchat/addmsgadmin.php
@@ -64,11 +64,16 @@ if (trim($form->msg) != '')
     	        $msg->chat_id = $Params['user_parameters']['chat_id'];
     	        $msg->user_id = $messageUserId;
     	        $msg->time = time();
     	        $msg->name_support = $userData->name_support;
 
-    	        if (isset($_POST['meta_msg'])) {
+                if (strpos($msg->msg,'[html]') !== false && !$currentUser->hasAccessTo('lhchat','htmlbbcodeenabled')) {
+                    $msg->msg = '[html] is disabled for you!';
+                    $msg->user_id = -1;
+                }
+
+    	        if (isset($_POST['meta_msg']) && $currentUser->hasAccessTo('lhchat','metamsgenabled')) {
                     $meta_msg = json_decode($_POST['meta_msg'], true);
                     if (is_array($meta_msg)) {
                         $metaContent = [];
 
                         foreach ($meta_msg as $meta_msg_key => $meta_msg_value) {
diff --git a/lhc_web/modules/lhchat/module.php b/lhc_web/modules/lhchat/module.php
index 92eed1f2f2..6a64eb55f6 100644
--- a/lhc_web/modules/lhchat/module.php
+++ b/lhc_web/modules/lhchat/module.php
@@ -711,7 +711,9 @@ $FunctionList['administrate_alert_icon'] = array('explain' => 'Allow operator to
 $FunctionList['prev_chats'] = array('explain' => 'Allow operator to see previous chats from visitor');
 $FunctionList['changedepartment'] = array('explain' => 'Allow operator to change chat department');
 $FunctionList['subject_chats'] = array('explain' => 'Allow operator see subject filtered chats');
 $FunctionList['subject_chats_options'] = array('explain' => 'Allow operator to choose what subjects should be applied as filter');
 $FunctionList['export_chats'] = array('explain' => 'Allow operator to export filtered chats');
+$FunctionList['htmlbbcodeenabled'] = array('explain' => 'Allow operator to use [html] bbcode.');
+$FunctionList['metamsgenabled'] = array('explain' => 'Allow operator to use meta_msg in message add interface.');
 
 ?>
\ No newline at end of file
diff --git a/lhc_web/modules/lhrestapi/addmsgadmin.php b/lhc_web/modules/lhrestapi/addmsgadmin.php
index c704ef1ba2..d91372c511 100644
--- a/lhc_web/modules/lhrestapi/addmsgadmin.php
+++ b/lhc_web/modules/lhrestapi/addmsgadmin.php
@@ -101,11 +101,16 @@ try {
                     $msg->msg = $msgText;
                     $msg->chat_id = $Chat->id;
                     $msg->user_id = $messageUserId;
                     $msg->time = time();
 
-                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '') {
+                    if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','htmlbbcodeenabled')) {
+                        $msg->msg = '[html] is disabled for you!';
+                        $msg->user_id = -1;
+                    }
+
+                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '' && erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','metamsgenabled')) {
                         $metaParts = json_decode($form->meta_msg,true);
                         // Parse meta message as it was bot message and store it within message
                         // We cannot store directly meta message content because it may contain callbacks which can be internal functions
                         // It would be huge security flaw in automated hosting environment
                         if ($metaParts !== null) {
@@ -127,10 +132,11 @@ try {
                                 $msg->meta_msg = json_encode($metaData);
                             }
                         }
                     }
 
+
                     if ($form->hasValidData('operator_name') && $form->operator_name != '') {
                         $msg->name_support = $form->operator_name;
                     } elseif ($form->sender == 'bot') {
 
                         $chatVariables = $Chat->chat_variables_array;

Vulnerable code:     	        if (isset($_POST['meta_msg'])) {
                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '') {
Fixed code: 
            if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassUser::instance()->hasAccessTo('lhchat','htmlbbcodeenabled')) {
                $msg->msg = '[html] is disabled for you!';
                $msg->user_id = -1;
            }

                if (strpos($msg->msg,'[html]') !== false && !$currentUser->hasAccessTo('lhchat','htmlbbcodeenabled')) {
                    $msg->msg = '[html] is disabled for you!';
                    $msg->user_id = -1;
                }

    	        if (isset($_POST['meta_msg']) && $currentUser->hasAccessTo('lhchat','metamsgenabled')) {
$FunctionList['htmlbbcodeenabled'] = array('explain' => 'Allow operator to use [html] bbcode.');
$FunctionList['metamsgenabled'] = array('explain' => 'Allow operator to use meta_msg in message add interface.');
                    if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','htmlbbcodeenabled')) {
                        $msg->msg = '[html] is disabled for you!';
                        $msg->user_id = -1;
                    }

                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '' && erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','metamsgenabled')) {