CVE-2022-1234: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-06T04:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/modules/lhcannedmsg/showsuggester.php, lhc_web/modules/lhcannedmsg/subject.php, lhc_web/modules/lhchat/blockuser.php, lhc_web/modules/lhchat/changestatus.php, lhc_web/modules/lhchat/checkchatstatus.php, lhc_web/modules/lhchat/editprevious.php, lhc_web/modules/lhchat/getmessageadmin.php, lhc_web/modules/lhchat/holdaction.php, lhc_web/modules/lhcobrowse/checkinitializer.php, lhc_web/modules/lhcobrowse/checkmirrorchanges.php, lhc_web/modules/lhuser/setinactive.php, lhc_web/modules/lhxml/accepttransfer.php, lhc_web/modules/lhxml/accepttransferbychat.php, lhc_web/modules/lhxml/chatdata.php, lhc_web/modules/lhxml/chatssynchro.php, lhc_web/modules/lhxml/checklogin.php, lhc_web/modules/lhxml/getuseronlinestatus.php, lhc_web/modules/lhxml/transferchat.php, lhc_web/modules/lhxml/userinfo.php
Commit date: 2022-04-04 23:40:53 -0400
Commit message: Add missing applicaiton/json header where missing

Diff: diff --git a/lhc_web/modules/lhcannedmsg/showsuggester.php b/lhc_web/modules/lhcannedmsg/showsuggester.php
index 3032a235766..88ad17c0f7c 100644
--- a/lhc_web/modules/lhcannedmsg/showsuggester.php
+++ b/lhc_web/modules/lhcannedmsg/showsuggester.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $tpl = erLhcoreClassTemplate::getInstance('lhcannedmsg/showsuggester.tpl.php');
 
 $chat = erLhcoreClassChat::getSession()->load( 'erLhcoreClassModelChat', $Params['user_parameters']['chat_id']);
 $tpl->set('chat',$chat);
 
diff --git a/lhc_web/modules/lhcannedmsg/subject.php b/lhc_web/modules/lhcannedmsg/subject.php
index 6c02e796c69..39e1b6e8c16 100644
--- a/lhc_web/modules/lhcannedmsg/subject.php
+++ b/lhc_web/modules/lhcannedmsg/subject.php
@@ -40,10 +40,11 @@ if ($canned instanceof erLhcoreClassModelCannedMsg)
         } else {
             $response = array('error' => false, 'message' => erTranslationClassLhTranslation::getInstance()->getTranslation('chat/subject','Please choose a subject'));
         }
 
         $db->commit();
+        header('Content-type: application/json');
         echo json_encode($response);
         exit;
     }
 
     if (isset($_GET['getsubjects'])) {
diff --git a/lhc_web/modules/lhchat/blockuser.php b/lhc_web/modules/lhchat/blockuser.php
index 684f31852dd..17ef10587f8 100644
--- a/lhc_web/modules/lhchat/blockuser.php
+++ b/lhc_web/modules/lhchat/blockuser.php
@@ -83,14 +83,16 @@ $params['user'] =  $currentUser->getUserData(true);
 
 if (empty($Errors)) {
     erLhcoreClassModelChatBlockedUser::blockChat($params);
     $tpl = erLhcoreClassTemplate::getInstance('lhkernel/alert_success.tpl.php');
     $tpl->set('msg', erTranslationClassLhTranslation::getInstance()->getTranslation('chat/blockedusers', 'Visitor was blocked!'));
+    header('Content-type: application/json');
     echo json_encode(array('error' => false, 'result' => $tpl->fetch()));
 } else {
     $tpl = erLhcoreClassTemplate::getInstance('lhkernel/validation_error.tpl.php');
     $tpl->set('errors', $Errors);
+    header('Content-type: application/json');
     echo json_encode(array('error' => true, 'result' => $tpl->fetch()));
 }
 
 exit;
 
diff --git a/lhc_web/modules/lhchat/changestatus.php b/lhc_web/modules/lhchat/changestatus.php
index 60682e30f02..ea924895f50 100644
--- a/lhc_web/modules/lhchat/changestatus.php
+++ b/lhc_web/modules/lhchat/changestatus.php
@@ -11,10 +11,11 @@ if (erLhcoreClassChat::hasAccessToRead($chat)) {
         
         $userData = $currentUser->getUserData();
         $changeStatus = (int) $_POST['ChatStatus'];
 
         if (!isset($_SERVER['HTTP_X_CSRFTOKEN']) || !$currentUser->validateCSFRToken($_SERVER['HTTP_X_CSRFTOKEN'])) {
+            header('Content-type: application/json');
             echo json_encode(array(
                 'error' => 'true',
                 'result' => erTranslationClassLhTranslation::getInstance()->getTranslation('chat/adminchat', 'Invalid CSRF token!')
             ));
             exit();
@@ -35,17 +36,20 @@ if (erLhcoreClassChat::hasAccessToRead($chat)) {
                 'status' => $changeStatus,
                 'allow_close_remote' => $currentUser->hasAccessTo('lhchat', 'allowcloseremote')
             ));
             
             erLhcoreClassChatEventDispatcher::getInstance()->dispatch('chat.data_changed',array('chat' => & $chat, 'user' => $currentUser));
-            
+
+            header('Content-type: application/json');
             echo json_encode(array(
                 'error' => 'false',
                 'is_owner' => $chat->user_id == $userData->id
             ));
             exit();
         } else {
+
+            header('Content-type: application/json');
             echo json_encode(array(
                 'error' => 'true',
                 'result' => erTranslationClassLhTranslation::getInstance()->getTranslation('chat/adminchat', 'Invalid chat status')
             ));
             exit();
diff --git a/lhc_web/modules/lhchat/checkchatstatus.php b/lhc_web/modules/lhchat/checkchatstatus.php
index 3f48691ef0c..cc49a75c2f2 100644
--- a/lhc_web/modules/lhchat/checkchatstatus.php
+++ b/lhc_web/modules/lhchat/checkchatstatus.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $activated = 'false';
 $result = 'false';
 $ott = '';
 $ru = '';
 
diff --git a/lhc_web/modules/lhchat/editprevious.php b/lhc_web/modules/lhchat/editprevious.php
index b333d930f5b..b21e8a38ab2 100644
--- a/lhc_web/modules/lhchat/editprevious.php
+++ b/lhc_web/modules/lhchat/editprevious.php
@@ -1,6 +1,8 @@
-<?php 
+<?php
+
+header('Content-type: application/json');
 
 try {
     $chat = erLhcoreClassChat::getSession()->load( 'erLhcoreClassModelChat', $Params['user_parameters']['chat_id']);
 
     if ( erLhcoreClassChat::hasAccessToRead($chat) )
diff --git a/lhc_web/modules/lhchat/getmessageadmin.php b/lhc_web/modules/lhchat/getmessageadmin.php
index 1f2a6f9fc4b..b35250f37fb 100644
--- a/lhc_web/modules/lhchat/getmessageadmin.php
+++ b/lhc_web/modules/lhchat/getmessageadmin.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 try {
 	$Chat = erLhcoreClassChat::getSession ()->load ( 'erLhcoreClassModelChat', $Params ['user_parameters'] ['chat_id'] );
 	
 	if (erLhcoreClassChat::hasAccessToRead ( $Chat )) {
 					
diff --git a/lhc_web/modules/lhchat/holdaction.php b/lhc_web/modules/lhchat/holdaction.php
index f341c5e0ce0..b9ca5477e29 100644
--- a/lhc_web/modules/lhchat/holdaction.php
+++ b/lhc_web/modules/lhchat/holdaction.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $db = ezcDbInstance::get();
 
 $db->beginTransaction();
 
 try {
diff --git a/lhc_web/modules/lhcobrowse/checkinitializer.php b/lhc_web/modules/lhcobrowse/checkinitializer.php
index 20f9248af3b..0078e054c01 100644
--- a/lhc_web/modules/lhcobrowse/checkinitializer.php
+++ b/lhc_web/modules/lhcobrowse/checkinitializer.php
@@ -1,6 +1,7 @@
-<?php 
+<?php
+header('Content-type: application/json');
 
 if (is_numeric($Params['user_parameters']['chat_id']))
 {
     $chat = erLhcoreClassChat::getSession()->load( 'erLhcoreClassModelChat', $Params['user_parameters']['chat_id']);
     if ( erLhcoreClassChat::hasAccessToRead($chat) )
diff --git a/lhc_web/modules/lhcobrowse/checkmirrorchanges.php b/lhc_web/modules/lhcobrowse/checkmirrorchanges.php
index 3a0abdb09b3..c3e49d6ba42 100644
--- a/lhc_web/modules/lhcobrowse/checkmirrorchanges.php
+++ b/lhc_web/modules/lhcobrowse/checkmirrorchanges.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 if (is_numeric($Params['user_parameters']['chat_id'])) {
     /*
      * If online user mode we have to make different check
      * */
     $browse = false;
diff --git a/lhc_web/modules/lhuser/setinactive.php b/lhc_web/modules/lhuser/setinactive.php
index 0944dce5c8a..ef817a08257 100644
--- a/lhc_web/modules/lhuser/setinactive.php
+++ b/lhc_web/modules/lhuser/setinactive.php
@@ -1,6 +1,7 @@
 <?php
+header('Content-type: application/json');
 
 $currentUser = erLhcoreClassUser::instance();
 $userData = $currentUser->getUserData(true);
 
 if (!isset($_SERVER['HTTP_X_CSRFTOKEN']) || !$currentUser->validateCSFRToken($_SERVER['HTTP_X_CSRFTOKEN'])) {
diff --git a/lhc_web/modules/lhxml/accepttransfer.php b/lhc_web/modules/lhxml/accepttransfer.php
index b87ac6d4b2d..d5653fb6c2e 100644
--- a/lhc_web/modules/lhxml/accepttransfer.php
+++ b/lhc_web/modules/lhxml/accepttransfer.php
@@ -1,6 +1,9 @@
 <?php
+
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/accepttransferbychat.php b/lhc_web/modules/lhxml/accepttransferbychat.php
index ef3e87dcbe7..6578254f092 100644
--- a/lhc_web/modules/lhxml/accepttransferbychat.php
+++ b/lhc_web/modules/lhxml/accepttransferbychat.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/chatdata.php b/lhc_web/modules/lhxml/chatdata.php
index 7f191c5d7de..df0e81bd94e 100644
--- a/lhc_web/modules/lhxml/chatdata.php
+++ b/lhc_web/modules/lhxml/chatdata.php
@@ -1,6 +1,9 @@
 <?php
+
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/chatssynchro.php b/lhc_web/modules/lhxml/chatssynchro.php
index 346996efb2c..da59ccd1b3f 100644
--- a/lhc_web/modules/lhxml/chatssynchro.php
+++ b/lhc_web/modules/lhxml/chatssynchro.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/checklogin.php b/lhc_web/modules/lhxml/checklogin.php
index 2e776e08589..a5bc042e635 100644
--- a/lhc_web/modules/lhxml/checklogin.php
+++ b/lhc_web/modules/lhxml/checklogin.php
@@ -1,10 +1,12 @@
 <?php
 
 // Debug
 //erLhcoreClassLog::write(print_r($_POST,true));
 
+header('Content-type: application/json');
+
 @ini_set('session.cookie_samesite', 'None');
 @ini_set('session.cookie_secure', true);
 
 $currentUser = erLhcoreClassUser::instance();
 
diff --git a/lhc_web/modules/lhxml/getuseronlinestatus.php b/lhc_web/modules/lhxml/getuseronlinestatus.php
index 422d4dcf84d..25ab3775a91 100644
--- a/lhc_web/modules/lhxml/getuseronlinestatus.php
+++ b/lhc_web/modules/lhxml/getuseronlinestatus.php
@@ -1,6 +1,8 @@
 <?php
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/transferchat.php b/lhc_web/modules/lhxml/transferchat.php
index 68c1a78de9e..c0cce06969c 100644
--- a/lhc_web/modules/lhxml/transferchat.php
+++ b/lhc_web/modules/lhxml/transferchat.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $currentUser = erLhcoreClassUser::instance();
 if (!$currentUser->isLogged() && !$currentUser->authenticate($_POST['username'],$_POST['password']))
 {
     exit;
 }
diff --git a/lhc_web/modules/lhxml/userinfo.php b/lhc_web/modules/lhxml/userinfo.php
index e7fcae3c47a..779cbe49906 100644
--- a/lhc_web/modules/lhxml/userinfo.php
+++ b/lhc_web/modules/lhxml/userinfo.php
@@ -1,7 +1,9 @@
 <?php
 
+header('Content-type: application/json');
+
 $tpl = erLhcoreClassTemplate::getInstance( 'lhxml/userinfo.tpl.php' );
 
 try {
 	$onlineUsers = erLhcoreClassModelChatOnlineUser::fetch((int)$Params['user_parameters']['user_id']);
 	$tpl->set('onlineUsers',$onlineUsers);

Vulnerable code:             
<?php 
<?php 
Fixed code: header('Content-type: application/json');

        header('Content-type: application/json');
    header('Content-type: application/json');
    header('Content-type: application/json');
            header('Content-type: application/json');

            header('Content-type: application/json');

            header('Content-type: application/json');
header('Content-type: application/json');

<?php

header('Content-type: application/json');
header('Content-type: application/json');

header('Content-type: application/json');

<?php
header('Content-type: application/json');
header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');


header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');