CVE-2022-0370: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-27T06:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/js/admintheme.form.angular.js, lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php, lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php, lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php
Commit date: 2022-01-26 00:49:34 -0500
Commit message: CSRF For personal theme

Diff: diff --git a/lhc_web/design/defaulttheme/js/admintheme.form.angular.js b/lhc_web/design/defaulttheme/js/admintheme.form.angular.js
index 3e1a314d38f..8284df78f67 100644
--- a/lhc_web/design/defaulttheme/js/admintheme.form.angular.js
+++ b/lhc_web/design/defaulttheme/js/admintheme.form.angular.js
@@ -89,7 +89,19 @@ lhcAppControllers.controller('IClickToCallFormGenerator',['$scope','$http','$loc
 			IClickToCallFormFactory.deleteResource(id,'static_css_content',removedItem.hash).then(function(data){	
 				
 			});			
 			delete that.staticCSSResources[field.hash];
 		};
+
+        this.initVariables = function () {
+            if (window.PersonalTheme.staticResources) {
+                this.staticResources = window.PersonalTheme.staticResources;
+            }
+            if (window.PersonalTheme.staticJSResources) {
+                this.staticJSResources = window.PersonalTheme.staticJSResources;
+            }
+            if (window.PersonalTheme.staticCSSResources) {
+                this.staticCSSResources = window.PersonalTheme.staticCSSResources;
+            }
+        }
 		
 }]);
\ No newline at end of file
diff --git a/lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php b/lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php
index 7f9afb6d2b7..6aa93598a87 100644
--- a/lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php
@@ -1,7 +1,7 @@
 <?php if (isset($errors)) : ?>
-<div data-alert class="alert alert-danger alert-dismissible fade show">
+<div data-alert class="alert alert-danger alert-dismissible fade show" ng-non-bindable>
 <?php if (!isset($hideErrorButton)) : ?>
 <button type="button" class="close" data-dismiss="alert" aria-label="Close">
     <span aria-hidden="true">&times;</span>
 </button>
 <?php endif;?>
diff --git a/lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php b/lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php
index d27cd4a8c98..fe3144c89aa 100644
--- a/lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php
@@ -2,11 +2,27 @@
 	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
 <?php endif; ?>
 
 <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
 
-<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform"  ng-init='<?php if ($form->static_content != '') : ?>cform.staticResources = <?php echo $form->static_content?>;<?php endif;?><?php if ($form->static_js_content != '') : ?>cform.staticJSResources = <?php echo $form->static_js_content?>;<?php endif;?><?php if ($form->static_css_content != '') : ?>cform.staticCSSResources = <?php echo $form->static_css_content?>;<?php endif;?>'>
+<script>
+    window.PersonalTheme = {};
+
+    <?php if ($form->static_content != '') : ?>
+    window.PersonalTheme.staticResources = <?php echo $form->static_content;?>
+    <?php endif; ?>
+
+    <?php if ($form->static_js_content != '') : ?>
+    window.PersonalTheme.staticJSResources = <?php echo $form->static_js_content;?>
+    <?php endif; ?>
+
+    <?php if ($form->static_css_content != '') : ?>
+    window.PersonalTheme.staticCSSResources = <?php echo $form->static_css_content;?>
+    <?php endif; ?>
+</script>
+
+<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform" ng-init="cform.initVariables();">
 
 	<!-- Nav tabs -->
 	<ul class="nav nav-tabs" role="tablist">
 		<li role="presentation" class="nav-item"><a class="active nav-link" href="#settings" aria-controls="settings" role="tab" data-toggle="tab"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('icclicktocallform/form','Settings');?></a></li>
         <li role="presentation" class="nav-item"><a class="nav-link" href="#chatattributes" aria-controls="chatattributes" role="tab" data-toggle="tab"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('icclicktocallform/form','Chat attributes');?></a></li>
diff --git a/lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php b/lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php
index 7d1c2ab3c64..a2d20220e72 100644
--- a/lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php
@@ -3,11 +3,11 @@
 </div>
 
 <form action="<?php echo erLhcoreClassDesign::baseurl('theme/personaltheme')?>" method="post" autocomplete="off" enctype="multipart/form-data">
 
     <div class="form-group">
-        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> Enable personal theme for me</label>
+        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> <?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Enable personal theme for me');?></label>
     </div>
 
     <?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Updated'); ?>
         <?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
     <?php endif; ?>

Vulnerable code: <div data-alert class="alert alert-danger alert-dismissible fade show">
<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform"  ng-init='<?php if ($form->static_content != '') : ?>cform.staticResources = <?php echo $form->static_content?>;<?php endif;?><?php if ($form->static_js_content != '') : ?>cform.staticJSResources = <?php echo $form->static_js_content?>;<?php endif;?><?php if ($form->static_css_content != '') : ?>cform.staticCSSResources = <?php echo $form->static_css_content?>;<?php endif;?>'>
        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> Enable personal theme for me</label>
Fixed code: 
        this.initVariables = function () {
            if (window.PersonalTheme.staticResources) {
                this.staticResources = window.PersonalTheme.staticResources;
            }
            if (window.PersonalTheme.staticJSResources) {
                this.staticJSResources = window.PersonalTheme.staticJSResources;
            }
            if (window.PersonalTheme.staticCSSResources) {
                this.staticCSSResources = window.PersonalTheme.staticCSSResources;
            }
        }
<div data-alert class="alert alert-danger alert-dismissible fade show" ng-non-bindable>
<script>
    window.PersonalTheme = {};

    <?php if ($form->static_content != '') : ?>
    window.PersonalTheme.staticResources = <?php echo $form->static_content;?>
    <?php endif; ?>

    <?php if ($form->static_js_content != '') : ?>
    window.PersonalTheme.staticJSResources = <?php echo $form->static_js_content;?>
    <?php endif; ?>

    <?php if ($form->static_css_content != '') : ?>
    window.PersonalTheme.staticCSSResources = <?php echo $form->static_css_content;?>
    <?php endif; ?>
</script>

<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform" ng-init="cform.initVariables();">
        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> <?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Enable personal theme for me');?></label>