CVE-2021-4177: Generation of Error Message Containing Sensitive Information (CWE-209)
value: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.3
Published: 2021-12-28T06:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php, lhc_web/ezcomponents/Base/src/file.php, lhc_web/ezcomponents/ConsoleTools/src/input/option.php, lhc_web/modules/lhchat/geoconfiguration.php
Commit date: 2021-12-27 01:37:08 -0500
Commit message: Disable to change city database location

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php
index e4cbac9c74..b1756f8080 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php
@@ -126,12 +126,12 @@
 								<p>
       	<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','bcmath php extension detected'); ?> - <?php echo extension_loaded ('bcmath' ) ? '<span class="badge badge-success">Yes</span>' : '<span class="badge badge-danger">No</span>'; ?>
       	</p>
 
       	                        <div class="form-group">
-								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database'); ?></label> 
-								    <input class="form-control" type="text" name="CityGeoLocation" value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
+								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database. Make sure you uploaded file in this location.'); ?></label>
+								    <input class="form-control" type="text" readonly value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
                                 </div>
 								
 								<div class="row">
 									<div class="col-6">
 										<label><input type="radio" name="MaxMindDetectionType" value="country" <?php (isset($geo_data['max_mind_detection_type']) && $geo_data['max_mind_detection_type'] == 'country') ? print 'checked="checked"' : '' ?> /><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','User country based detection, faster')?></label>
diff --git a/lhc_web/ezcomponents/Base/src/file.php b/lhc_web/ezcomponents/Base/src/file.php
index 843399c796..9d5329b9fa 100644
--- a/lhc_web/ezcomponents/Base/src/file.php
+++ b/lhc_web/ezcomponents/Base/src/file.php
@@ -108,11 +108,11 @@ class ezcBaseFile
      *         a directory or does not exist.
      * @throws ezcBaseFilePermissionException if the $sourceDir directory could
      *         not be opened for reading.
      * @return array
      */
-    static public function walkRecursive( $sourceDir, array $includeFilters = array(), array $excludeFilters = array(), $callback, &$callbackContext )
+    static public function walkRecursive( $sourceDir, array $includeFilters, array $excludeFilters, $callback, &$callbackContext )
     {
         if ( !is_dir( $sourceDir ) )
         {
             throw new ezcBaseFileNotFoundException( $sourceDir, 'directory' );
         }
diff --git a/lhc_web/ezcomponents/ConsoleTools/src/input/option.php b/lhc_web/ezcomponents/ConsoleTools/src/input/option.php
index 447688efda..e9d4f03a61 100644
--- a/lhc_web/ezcomponents/ConsoleTools/src/input/option.php
+++ b/lhc_web/ezcomponents/ConsoleTools/src/input/option.php
@@ -145,12 +145,12 @@ class ezcConsoleOption
      *
      * @throws ezcConsoleInvalidOptionNameException If the option names start with a "-" 
      *                                              sign or contain whitespaces.
      */
     public function __construct( 
-        $short = '', 
-        $long, 
+        $short = '',
+        $long = '',
         $type = ezcConsoleInput::TYPE_NONE, 
         $default = null, 
         $multiple = false,
         $shorthelp = 'No help available.',
         $longhelp = 'Sorry, there is no help text available for this parameter.', 
diff --git a/lhc_web/modules/lhchat/geoconfiguration.php b/lhc_web/modules/lhchat/geoconfiguration.php
index 18d6f516f8..dc90e67ec5 100644
--- a/lhc_web/modules/lhchat/geoconfiguration.php
+++ b/lhc_web/modules/lhchat/geoconfiguration.php
@@ -107,13 +107,10 @@ if ( isset($_POST['StoreGeoIPConfiguration']) ) {
             ezcInputFormDefinitionElement::OPTIONAL, 'string'
         ),
         'MaxMindDetectionType' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'string'
         ),
-        'CityGeoLocation' => new ezcInputFormDefinitionElement(
-            ezcInputFormDefinitionElement::OPTIONAL, 'string'
-        ),
         'ipapi_key' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'string'
         ),
         'abstractapi_key' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'string'
@@ -196,19 +193,19 @@ if ( isset($_POST['StoreGeoIPConfiguration']) ) {
                 }
 
             } elseif ($form->UseGeoIP == 'max_mind') {
                 $data['geo_service_identifier'] = 'max_mind';                
                 $data['max_mind_detection_type'] = $form->hasValidData('MaxMindDetectionType') ? $form->MaxMindDetectionType : 'city';
-                $data['max_mind_city_location'] = $form->CityGeoLocation != '' ? $form->CityGeoLocation : 'var/external/geoip/GeoLite2-City.mmdb';
-                          
+                $data['max_mind_city_location'] = 'var/external/geoip/GeoLite2-City.mmdb';
+
                 if ($data['max_mind_detection_type'] == 'city' && !file_exists($data['max_mind_city_location'])) {
                 	$Errors[] = erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','MaxMind city file does not exists!');
                 } elseif (!file_exists('var/external/geoip/GeoLite2-Country.mmdb')) {
                 	$data['max_mind_detection_type'] = 'country';
                 	$Errors[] = erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','MaxMind country file does not exists!');
                 }
-                
+
                 if (empty($Errors)) {
 	                $responseDetection = erLhcoreClassModelChatOnlineUser::getUserData('max_mind','94.23.200.91',array('city_file' => $data['max_mind_city_location'],'detection_type' => $data['max_mind_detection_type']));                
 	                if ( $responseDetection == false || !isset($responseDetection->country_code) || !isset($responseDetection->country_name) ) {
 	                    $Errors[] = erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Setting service provider failed, please check that MaxMind database files exists!');
 	                }

Vulnerable code: 								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database'); ?></label> 
								    <input class="form-control" type="text" name="CityGeoLocation" value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
    static public function walkRecursive( $sourceDir, array $includeFilters = array(), array $excludeFilters = array(), $callback, &$callbackContext )
        $short = '', 
        $long, 
        'CityGeoLocation' => new ezcInputFormDefinitionElement(
            ezcInputFormDefinitionElement::OPTIONAL, 'string'
        ),
                $data['max_mind_city_location'] = $form->CityGeoLocation != '' ? $form->CityGeoLocation : 'var/external/geoip/GeoLite2-City.mmdb';
                          
                
Fixed code: 								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database. Make sure you uploaded file in this location.'); ?></label>
								    <input class="form-control" type="text" readonly value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
    static public function walkRecursive( $sourceDir, array $includeFilters, array $excludeFilters, $callback, &$callbackContext )
        $short = '',
        $long = '',
                $data['max_mind_city_location'] = 'var/external/geoip/GeoLite2-City.mmdb';