CVE-2022-0502: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-06T11:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php, lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php
Commit date: 2022-02-06 05:48:12 -0500
Commit message: Canned messages fixes

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php
index 36a85529671..0cd8fb973b6 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php
@@ -1,11 +1,11 @@
 <script>
     var languageCanned<?php echo $canned_message->id?> = <?php echo json_encode(json_decode($canned_message->languages, true), JSON_HEX_APOS) ?>;
     var languageDialects = <?php echo json_encode(array_values(erLhcoreClassModelSpeechLanguageDialect::getDialectsGrouped()))?>;
 </script>
 
-<div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController()<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
+<div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController();<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
 
 <ul class="nav nav-pills" role="tablist" id="canned-main-tabs">
     <li role="presentation" class="nav-item" ><a class="nav-link active" href="#main" aria-controls="main" role="tab" data-toggle="tab" ><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/cannedmsg','Main');?></a></li>
     <li role="presentation" class="nav-item" ><a class="nav-link" href="#activity-period" aria-controls="activity-period" role="tab" data-toggle="tab" ><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/cannedmsg','Activity period');?></a></li>
     <li ng-repeat="lang in cmsg.languages" class="nav-item" role="presentation"><a href="#lang-{{$index}}" class="nav-link" aria-controls="lang-{{$index}}" role="tab" data-toggle="tab" ><i class="material-icons mr-0">&#xE894;</i> [{{cmsg.getLanguagesChecked(lang)}}]</a></li>
diff --git a/lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php b/lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php
index 51682a4eaff..85e12ebf69b 100644
--- a/lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php
@@ -64,11 +64,11 @@ if ($pages->items_total > 0) {
 
 <script>
     var languageDialects = <?php echo json_encode(array_values(erLhcoreClassModelSpeechLanguageDialect::getDialectsGrouped()))?>;
 </script>
 
-<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.iniController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
+<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.initController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
 
     <ul class="nav nav-pills" role="tablist" id="canned-main-tabs">
         <li class="nav-item" role="presentation" ><a class="nav-link active"href="#main" aria-controls="main" role="tab" data-toggle="tab" ><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Main');?></a></li>
         <li class="nav-item" ng-repeat="lang in cmsg.languages" role="presentation"><a class="nav-link" href="#lang-{{$index}}" aria-controls="lang-{{$index}}" role="tab" data-toggle="tab" ><i class="material-icons mr-0">&#xE894;</i> [{{cmsg.getLanguagesChecked(lang)}}]</a></li>
         <li class="nav-item" ><a class="nav-link" href="#addlanguage" ng-click="cmsg.addLanguage()"><i class="material-icons">&#xE145;</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Add translation');?></a></li>
@@ -116,17 +116,17 @@ if ($pages->items_total > 0) {
                 <div role="tabpanel" class="tab-pane active" id="main-extension">
                     <div class="form-group">
                         <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/cannedmsg','Message');?>*</label>
                         <?php $bbcodeOptions = array('selector' => '#canned-message'); ?>
                         <?php include(erLhcoreClassDesign::designtpl('lhbbcode/toolbar.tpl.php')); ?>
-                        <textarea class="form-control" rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
+                        <textarea class="form-control" ng-non-bindable rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
                     </div>
                     <div class="form-group">
                         <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/cannedmsg','Fallback message');?></label>
                         <?php $bbcodeOptions = array('selector' => '#id-FallbackMessage'); ?>
                         <?php include(erLhcoreClassDesign::designtpl('lhbbcode/toolbar.tpl.php')); ?>
-                        <textarea class="form-control" rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>
+                        <textarea class="form-control" ng-non-bindable rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>
                     </div>
                 </div>
                 <?php $canned_message = $canned_msg; ?>
                 <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsg/custom_fallback_tab_content_multiinclude.tpl.php')); ?>
             </div>

Vulnerable code: <div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController()<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.iniController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
                        <textarea class="form-control" rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
                        <textarea class="form-control" rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>
Fixed code: <div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController();<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.initController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
                        <textarea class="form-control" ng-non-bindable rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
                        <textarea class="form-control" ng-non-bindable rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>