CVE-2023-2949: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-28T04:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: interface/forms/eye_mag/js/eye_base.php, interface/main/finder/dynamic_finder.php, interface/main/finder/dynamic_finder_ajax.php, library/custom_template/share_template.php
Commit date: 2023-04-08 22:23:39 -0700
Commit message: fixes: couple more misc fixes (#6336)


Diff: diff --git a/interface/forms/eye_mag/js/eye_base.php b/interface/forms/eye_mag/js/eye_base.php
index 1055e478e40..6c05ba3d9a7 100644
--- a/interface/forms/eye_mag/js/eye_base.php
+++ b/interface/forms/eye_mag/js/eye_base.php
@@ -367,11 +367,11 @@ function unlock() {
 function create_task(to_id,task,to_type) {
     $(this).addClass('fa-spin');
     var url = "../../forms/eye_mag/taskman.php";
     var formData = {
         'action'            : "make_task",
-        'from_id'           : <?php echo js_escape($providerID); ?>,
+        'from_id'           : <?php echo attr_js($providerID); ?>,
         'to_id'             : to_id,
         'pid'               : $('#pid').val(),
         'doc_type'          : task,
         'enc'               : $('#encounter').val(),
         'form_id'           : $('#form_id').val()
diff --git a/interface/main/finder/dynamic_finder.php b/interface/main/finder/dynamic_finder.php
index cfa81289da7..39a99cfa23c 100644
--- a/interface/main/finder/dynamic_finder.php
+++ b/interface/main/finder/dynamic_finder.php
@@ -248,14 +248,14 @@ $loading = "<div class='spinner-border' role='status'><span class='sr-only'>" .
     var uspfx = '<?php echo attr($uspfx); ?>';
 
     $(function () {
         // Initializing the DataTable.
         //
-        let serverUrl = "dynamic_finder_ajax.php?csrf_token_form=" + <?php echo js_url(CsrfUtils::collectCsrfToken()); ?>;
+        let serverUrl = "dynamic_finder_ajax.php";
         let srcAny = <?php echo js_url($searchAny); ?>;
         if (srcAny) {
-            serverUrl += "&search_any=" + srcAny;
+            serverUrl += "?search_any=" + srcAny;
         }
         var oTable = $('#pt_table').dataTable({
             "processing": true,
             // next 2 lines invoke server side processing
             "serverSide": true,
diff --git a/interface/main/finder/dynamic_finder_ajax.php b/interface/main/finder/dynamic_finder_ajax.php
index 4a8bfd41d5f..3308896e8b1 100644
--- a/interface/main/finder/dynamic_finder_ajax.php
+++ b/interface/main/finder/dynamic_finder_ajax.php
@@ -21,14 +21,14 @@ require_once($GLOBALS['srcdir'] . "/options.inc.php");
 
 use OpenEMR\Events\BoundFilter;
 use OpenEMR\Events\PatientFinder\PatientFinderFilterEvent;
 use OpenEMR\Events\PatientFinder\ColumnFilter;
 
-// Not checking csrf for good reasons.
-//  1. Not needed since no state changes in this script
-//  2. It will cause potential session clash fails because it throws a popup which messes things up
-//     when opening a patient in a new window.
+// Not checking csrf since it breaks when opening up a patient in a new frame.
+//  Also note that csrf checking is not needed in this script because of following 2 reasons.
+//  1. cookie_samesite in OpenEMR is set to 'Strict', which is an effective security measure to stop csrf vulnerabilities.
+//  2. Additionally, in this script there are no state changes, thus it is not even sensitive to csrf vulnerabilities.
 
 $popup = empty($_REQUEST['popup']) ? 0 : 1;
 $searchAny = !empty($_GET['search_any']) && empty($_GET['sSearch']) ? $_GET['search_any'] : "";
 
 // With the ColReorder or ColReorderWithResize plug-in, the expected column
diff --git a/library/custom_template/share_template.php b/library/custom_template/share_template.php
index ec5a28bae92..0cad95b02df 100644
--- a/library/custom_template/share_template.php
+++ b/library/custom_template/share_template.php
@@ -53,11 +53,11 @@ $list_id = $_REQUEST['list_id'];
                 $.ajax({
                 type: "POST",
                 url: "ajax_code.php",
                 dataType: "html",
                 data: {
-                     list_id: <?php echo htmlspecialchars($list_id, ENT_QUOTES);?>,
+                     list_id: <?php echo js_escape($list_id); ?>,
                      multi: val,
                      source: "save_provider"
                 },
                 async: false,
                 success: function(thedata){
@@ -69,11 +69,11 @@ $list_id = $_REQUEST['list_id'];
                 });
                 dlgclose();
                 return;
                 }
                 else{
-                    alert("<?php echo addslashes(xl('You should select at least one Provider'));?>");
+                    alert(<?php echo xlj('You should select at least one Provider');?>);
                 }
 
         }
         </script>
     </head>
@@ -95,17 +95,17 @@ $list_id = $_REQUEST['list_id'];
                                         $sel = "selected";
                                     } else {
                                         $sel = '';
                                     }
                                 }
-                                echo "<option value='" . htmlspecialchars($row['id'], ENT_QUOTES) . "' $sel>" . htmlspecialchars($row['lname'] . "," . $row['fname'], ENT_QUOTES) . "</option>";
+                                echo "<option value='" . attr($row['id']) . "' $sel>" . text($row['lname'] . "," . $row['fname']) . "</option>";
                             }
                             ?>
                         </select>
                     </td>
                     <td>
-                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo htmlspecialchars(xl('Save'), ENT_QUOTES);?></span></a>
+                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo xlt('Save');?></span></a>
                     </td>
                 </tr>
             </table>
         </form>
     </body>

Vulnerable code:         'from_id'           : <?php echo js_escape($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php?csrf_token_form=" + <?php echo js_url(CsrfUtils::collectCsrfToken()); ?>;
            serverUrl += "&search_any=" + srcAny;
// Not checking csrf for good reasons.
//  1. Not needed since no state changes in this script
//  2. It will cause potential session clash fails because it throws a popup which messes things up
//     when opening a patient in a new window.
                     list_id: <?php echo htmlspecialchars($list_id, ENT_QUOTES);?>,
                    alert("<?php echo addslashes(xl('You should select at least one Provider'));?>");
                                echo "<option value='" . htmlspecialchars($row['id'], ENT_QUOTES) . "' $sel>" . htmlspecialchars($row['lname'] . "," . $row['fname'], ENT_QUOTES) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo htmlspecialchars(xl('Save'), ENT_QUOTES);?></span></a>
Fixed code:         'from_id'           : <?php echo attr_js($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php";
            serverUrl += "?search_any=" + srcAny;
// Not checking csrf since it breaks when opening up a patient in a new frame.
//  Also note that csrf checking is not needed in this script because of following 2 reasons.
//  1. cookie_samesite in OpenEMR is set to 'Strict', which is an effective security measure to stop csrf vulnerabilities.
//  2. Additionally, in this script there are no state changes, thus it is not even sensitive to csrf vulnerabilities.
                     list_id: <?php echo js_escape($list_id); ?>,
                    alert(<?php echo xlj('You should select at least one Provider');?>);
                                echo "<option value='" . attr($row['id']) . "' $sel>" . text($row['lname'] . "," . $row['fname']) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo xlt('Save');?></span></a>