CVE-2017-9451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-06-06T16:29Z
Repository: https://github.com/flatCore/flatCore-CMS
Language: PHP
Files changed: acp/core/dashboard.system.php, acp/core/list.themes.php, acp/core/pages.edit_form.php, acp/core/pages.snippets.php, acp/core/system.stats.php, acp/core/user.groups.php, acp/core/user.list.php
Commit date: 2017-06-07 09:11:36 +0200
Commit message: Prevent XSS Vulnerability

Issue: Bug Report: XSS Vulnerability in acp.php on FlatCore v1.4.6 #34

Diff: diff --git a/acp/core/dashboard.system.php b/acp/core/dashboard.system.php
index 4759823..e829ad9 100644
--- a/acp/core/dashboard.system.php
+++ b/acp/core/dashboard.system.php
@@ -1,89 +1,96 @@
 <?php
 
 //prohibit unauthorized access
 require 'core/access.php';
 
-echo '<h3>System</h3>';
+
+echo '<hr class="shadow" style="margin-top:0;">';
 
 echo '<div class="row">';
 
 echo '<div class="col-md-4">';
-echo '<h5>Config</h5>';
-echo '<dl class="dl-horizontal">';
-echo '<dt>Server:</dt><dd>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</dd>';
+
+echo '<div class="panel panel-default">';
+
+echo '<div class="panel-heading">Config</div>';
+echo '<table class="table table-condensed">';
+echo '<tr><td>Server:</td><td>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</td></tr>';
 if($prefs_mailer_adr != '') {
-	echo '<dt>System E-Mails:</dt><dd>' . $prefs_mailer_adr . '</dd>';
+	echo '<tr><td>System E-Mails:</td><td>' . $prefs_mailer_adr . '</td></tr>';
 } else {
-	echo '<dt>System E-Mails:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
+	echo '<tr><td>System E-Mails:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
 }
 if($prefs_mailer_name != '') {
-	echo '<dt>E-Mail Name:</dt><dd>' . $prefs_mailer_name . '</dd>';
+	echo '<tr><td>E-Mail Name:</td><td>' . $prefs_mailer_name . '</td></tr>';
 } else {
-	echo '<dt>E-Mail Name:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
+	echo '<tr><td>E-Mail Name:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
 }
-echo '</dl>';
-
+echo '</table>';
 
-echo '<hr>';
+echo '</div>';
 
-echo '<h4>' . $lang['f_user_drm'] . '</h4>';
 
+echo '<div class="panel panel-default">';
+echo '<div class="panel-heading">' . $lang['f_user_drm'] . '</div>';
+echo '<div class="panel-body">';
 
 echo"<p><span class='glyphicon glyphicon-user'></span> $_SESSION[user_firstname] $_SESSION[user_lastname] ($_SESSION[user_nick])</p>";
 
 $list_str = '<ul class="list-unstyled" style="padding-left:16px;">';
 
 if($_SESSION['acp_pages'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_pages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_pages'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_pages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_pages'].'</li>';
 }
 
 if($_SESSION['acp_editpages'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editpages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editpages'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editpages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editpages'].'</li>';
 }
 
 if($_SESSION['acp_editownpages'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editownpages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editownpages'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editownpages]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editownpages'].'</li>';
 }
 
 if($_SESSION['acp_files'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_files]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_files'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
 }
 
 if($_SESSION['acp_user'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user'].'</li>';
 }
 
 if($_SESSION['acp_system'] == "allowed") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_system]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_system'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
 }
 
 if($_SESSION['drm_can_publish'] == "true") {
-	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user_can_publish]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user_can_publish'].'</li>';
 } else {
-	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_user_can_publish]</li>";
+	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user_can_publish'].'</li>';
 }
 
 
 $list_str .= "</ul>";
 
 echo $list_str;
 
+echo '</div>';
 
 echo '</div>';
+echo '</div>';
 
 
 echo '<div class="col-md-8">';
 
 echo '<ul class="nav nav-tabs" id="bsTabs">';
diff --git a/acp/core/list.themes.php b/acp/core/list.themes.php
index 0dc51fa..af236b6 100644
--- a/acp/core/list.themes.php
+++ b/acp/core/list.themes.php
@@ -45,11 +45,11 @@ if(isset($_POST['saveDesign'])) {
 
 if($sys_message != ""){
 	print_sysmsg("$sys_message");
 }
 
-echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=moduls&sub=t" method="POST" class="form-horizontal">';
+echo '<form action="acp.php?tn=moduls&sub=t" method="POST" class="form-horizontal">';
 echo '<fieldset>';
 echo '<legend>'.$lang['f_prefs_layout'].'</legend>';
 
 
 $arr_Styles = get_all_templates();
diff --git a/acp/core/pages.edit_form.php b/acp/core/pages.edit_form.php
index 7e681e9..b0eaab3 100644
--- a/acp/core/pages.edit_form.php
+++ b/acp/core/pages.edit_form.php
@@ -1,11 +1,11 @@
 <?php
 //prohibit unauthorized access
 require 'core/access.php';
 
 
-echo"\n <form id='editpage' action='$_SERVER[PHP_SELF]?tn=pages&sub=edit&editpage=$editpage' class='form-horizontal' method='POST'>\n";
+echo '<form id="editpage" action="acp.php?tn=pages&sub=edit&editpage='.$editpage.'" class="form-horizontal" method="POST">';
 
 $custom_fields = get_custom_fields();
 sort($custom_fields);
 $cnt_custom_fields = count($custom_fields);
 echo '<div class="row" style="margin-right:0;">';
@@ -133,34 +133,34 @@ for($i=0;$i<10;$i++) {
 }
 $select_page_redirect_code .= '</select>';
 
 echo tpl_form_control_group('',$lang['f_page_redirect'],'<div class="row"><div class="col-md-3">'.$select_page_redirect_code.'</div><div class="col-md-9"><input class="form-control" type="text" name="page_redirect" value="'.$page_redirect.'"></div></div>');
 
-echo'</div>'; /* EOL tab_info */
+echo '</div>'; /* EOL tab_info */
 
 
 /* tab_content */
-echo'<div class="tab-pane fade" id="content">';
+echo '<div class="tab-pane fade" id="content">';
 
 echo '<textarea name="page_content" class="form-control mceEditor textEditor switchEditor" id="textEditor">'.$page_content.'</textarea>';
 
 echo"</div>";
 /* EOL tab_content */
 
 
 /* tab_extracontent */
 
-echo'<div class="tab-pane fade" id="extracontent">';
+echo '<div class="tab-pane fade" id="extracontent">';
 
 echo '<textarea name="page_extracontent" class="form-control mceEditor textEditor switchEditor" id="textEditor2">'.$page_extracontent.'</textarea>';
 
-echo"</div>"; /* EOL tab_extracontent */
+echo '</div>'; /* EOL tab_extracontent */
 
 
 
 /* tab_meta */
-echo'<div class="tab-pane fade" id="meta">';
+echo '<div class="tab-pane fade" id="meta">';
 
 echo tpl_form_control_group('',$lang['f_page_title'],'<input class="form-control" type="text" name="page_title" value="'.$page_title.'">');
 
 if($page_meta_author == "") {
 	$page_meta_author = $_SESSION['user_firstname'] .' '. $_SESSION['user_lastname'];
@@ -169,43 +169,33 @@ if($page_meta_author == "") {
 echo tpl_form_control_group('',$lang['f_meta_author'],'<input class="form-control" type="text" name="page_meta_author" value="'.$page_meta_author.'">');
 echo tpl_form_control_group('',$lang['f_meta_keywords'],'<input class="form-control" type="text" name="page_meta_keywords" value="'.$page_meta_keywords.'" data-role="tagsinput">');
 echo tpl_form_control_group('',$lang['f_meta_description'],"<textarea name='page_meta_description' class='form-control cntValues' rows='5'>$page_meta_description</textarea>");
 
 
-echo"<div class='form-group'>
-		<label class='control-label control-label-normal col-sm-2'>$lang[page_thumbnail]</label>
-		<div class='col-sm-10'>";
+echo '<div class="form-group">';
+echo '<label class="control-label control-label-normal col-sm-2">'.$lang['page_thumbnail'].'</label>';
+echo '<div class="col-sm-10">';
 		
 echo '<div class="scroll-container">';
 echo '<select name="page_thumbnail" class="form-control image-picker">';
-echo "<option value=''>$lang[page_thumbnail]</option>";
+echo '<option value="">'.$lang['page_thumbnail'].'</option>';
 $arr_Images = get_all_images();
 	foreach($arr_Images as $page_thumbnails) {
 		$selected = "";
 		if($page_thumbnail == "$page_thumbnails") {
 			$selected = "selected";
 		}
 		echo '<option '.$selected.' data-img-src="/content/images/'.$page_thumbnails.'" class="masonry-item" value="'.$page_thumbnails.'">'.$page_thumbnails.'</option>';
 }
-echo"</select>";
+echo '</select>';
+echo '</div>';
+echo '</div>';
 echo '</div>';
-echo"</div>
-	 </div>";
-
-echo"</fieldset>";
-
 
-foreach($arr_Images as $page_thumbnails) {
-		$selected = "";
-		if($page_thumbnail == "$page_thumbnails") {
-			$selected = "selected";
-		}
-		echo "<option $selected data-img-src='/content/iamages/$page_thumbnails' value='$page_thumbnails'>$page_thumbnails</option>";
-}
+echo '</fieldset>';
 
 
-		
 $select_page_meta_robots  = '<select name="page_meta_robots" class="form-control">';
 $select_page_meta_robots .= '<option value="all" '.($page_meta_robots == "all" ? 'selected="selected"' :'').'>all</option>';
 $select_page_meta_robots .= '<option value="noindex" '.($page_meta_robots == "noindex" ? 'selected="selected"' :'').'>noindex</option>';
 $select_page_meta_robots .= '<option value="nofollow" '.($page_meta_robots == "nofollow" ? 'selected="selected"' :'').'>nofollow</option>';
 $select_page_meta_robots .= '<option value="noodp" '.($page_meta_robots == "noodp" ? 'selected="selected"' :'').'>noodp</option>';
@@ -213,37 +203,37 @@ $select_page_meta_robots .= '<option value="noydir" '.($page_meta_robots == "noy
 $select_page_meta_robots .= '</select>';
 echo tpl_form_control_group('',$lang['f_meta_robots'],$select_page_meta_robots);
 
 
 
-echo'</div>'; /* EOL tab_meta */
+echo '</div>'; /* EOL tab_meta */
 
 
 
 /* tab_head */
-echo'<div class="tab-pane fade" id="head">';
+echo '<div class="tab-pane fade" id="head">';
 
 echo $lang['f_head_styles'];
 echo '<span class="silent"> &lt;style type=&quot;text/css&quot;&gt;</span> ... <span class="silent">&lt;/styles&gt;</span>';
-echo "<textarea name='page_head_styles' class='form-control aceEditor_css' rows='12'>$page_head_styles</textarea>";
+echo '<textarea name="page_head_styles" class="form-control aceEditor_css" rows="12">'.$page_head_styles.'</textarea>';
 echo '<div id="CSSeditor"></div>';
 
 echo '<hr>';
 
 echo $lang['f_head_enhanced'];
 echo '<span class="silent"> &lt;head&gt;</span> ... <span class="silent">&lt;/head&gt;</span>';
-echo "<textarea name='page_head_enhanced' class='form-control aceEditor_html' rows='12'>$page_head_enhanced</textarea>";
+echo '<textarea name="page_head_enhanced" class="form-control aceEditor_html" rows="12">'.$page_head_enhanced.'</textarea>';
 echo '<div id="HTMLeditor"></div>';
 
-echo'</div>'; /* EOL tab_head */
+echo '</div>'; /* EOL tab_head */
 
 
 
 if($cnt_custom_fields > 0) {
 
 /* tab custom fields */
-echo'<div class="tab-pane fade" id="custom">';
+echo '<div class="tab-pane fade" id="custom">';
 
 	for($i=0;$i<$cnt_custom_fields;$i++) {
 		
 		$custom_field_value = '';
 		$custom_field_value = ${$custom_fields[$i]};
@@ -257,15 +247,15 @@ echo'<div class="tab-pane fade" id="custom">';
 			$label = substr($custom_fields[$i],15);
 			echo tpl_form_control_group('',$label,"<textarea class='mceEditor_small' name='$custom_fields[$i]'>" .$custom_field_value. "</textarea>");
 		}		
 	}
 
-echo'</div>'; /* EOL tab custom fields */
+echo '</div>'; /* EOL tab custom fields */
 
 }
 
-echo"</div>"; // EOL fancytabs
+echo '</div>'; // EOL fancytabs
 
 echo '</div>';
 echo '<div class="col-lg-3 col-md-4 col-sm-12">';
 
 
diff --git a/acp/core/pages.snippets.php b/acp/core/pages.snippets.php
index a7a6544..5eeb0ba 100644
--- a/acp/core/pages.snippets.php
+++ b/acp/core/pages.snippets.php
@@ -180,11 +180,11 @@ echo '</div>';
 echo '</div>';
 
 echo '</div>';
 echo '<div class="col-md-9">';
 
-echo "<form action='$_SERVER[PHP_SELF]?tn=pages&sub=snippets' method='POST'>";
+echo "<form action='acp.php?tn=pages&sub=snippets' method='POST'>";
 
 
 
 
 echo '<div class="row">';
diff --git a/acp/core/system.stats.php b/acp/core/system.stats.php
index d6efe60..6cda2ce 100644
--- a/acp/core/system.stats.php
+++ b/acp/core/system.stats.php
@@ -43,11 +43,11 @@ $filename = $_SESSION['filename'];
 $log_dir = "../" . FC_CONTENT_DIR . "/SQLite";
 $logfiles = glob("$log_dir/logfile*");
 
 echo"<fieldset>";
 echo"<legend>$lang[select_logfile]</legend>";
-echo"<form action='$_SERVER[PHP_SELF]?tn=system&sub=stats' method='POST' class='form-inline'>";
+echo"<form action='acp.php?tn=system&sub=stats' method='POST' class='form-inline'>";
 echo '<div class="form-group">';
 echo"<select name='select_logfile' class='form-control'>";
 
 foreach($logfiles as $fn) {
 	
diff --git a/acp/core/user.groups.php b/acp/core/user.groups.php
index 810c5ff..6fdfdef 100644
--- a/acp/core/user.groups.php
+++ b/acp/core/user.groups.php
@@ -159,11 +159,11 @@ $result= $result->fetchAll(PDO::FETCH_ASSOC);
 $editgroup = (int) $_POST['editgroup'];
 
 
 echo '<fieldset>';
 echo '<legend>'.$lang['legend_choose_group'].'</legend>';
-echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=user&sub=groups" method="POST">';
+echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
 
 echo '<div class="row">';
 echo '<div class="col-md-5">';
 
 echo '<div class="form-group">';
@@ -229,11 +229,11 @@ unset($group_name,$group_description,$hidden_field);
  */
 
 echo '<fieldset>';
 echo '<legend>'.$lang['legend_groups_data'].'</legend>';
 
-echo '<form action="'.$_SERVER[PHP_SELF].'?tn=user&sub=groups" method="POST">';
+echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
 
 echo '<div class="row">';
 echo '<div class="col-md-8">';
 
 echo '<label class="">'.$lang['label_group_name'].'</label>';
diff --git a/acp/core/user.list.php b/acp/core/user.list.php
index fe1d8f3..643b62c 100644
--- a/acp/core/user.list.php
+++ b/acp/core/user.list.php
@@ -194,11 +194,11 @@ for($x=0;$x<$cnt_pages;$x++) {
 $pag_forwardlink = "<a class='btn btn-primary' href='$_SERVER[PHP_SELF]?tn=user&sub=list&start=$next_start&sort=$_GET[sort]'>$lang[pagination_forward]</a>";
 
 
 echo '<div class="row">';
 echo '<div class="col-md-5">';
-echo "<form action='$_SERVER[PHP_SELF]?tn=user' class='form-inline' method='POST'>";
+echo "<form action='acp.php?tn=user' class='form-inline' method='POST'>";
 
 echo '<div class="input-group">';
 echo '<span class="input-group-addon"><span class="glyphicon glyphicon-filter"></span></span>';
 echo '<input type="text" name="findUser" class="form-control" placeholder="Filter">';
 echo '</div>';

Vulnerable code: echo '<h3>System</h3>';
echo '<h5>Config</h5>';
echo '<dl class="dl-horizontal">';
echo '<dt>Server:</dt><dd>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</dd>';
	echo '<dt>System E-Mails:</dt><dd>' . $prefs_mailer_adr . '</dd>';
	echo '<dt>System E-Mails:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
	echo '<dt>E-Mail Name:</dt><dd>' . $prefs_mailer_name . '</dd>';
	echo '<dt>E-Mail Name:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
echo '</dl>';

echo '<hr>';
echo '<h4>' . $lang['f_user_drm'] . '</h4>';
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_pages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_pages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editownpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editownpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_system]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user_can_publish]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_user_can_publish]</li>";
echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=moduls&sub=t" method="POST" class="form-horizontal">';
echo"\n <form id='editpage' action='$_SERVER[PHP_SELF]?tn=pages&sub=edit&editpage=$editpage' class='form-horizontal' method='POST'>\n";
echo'</div>'; /* EOL tab_info */
echo'<div class="tab-pane fade" id="content">';
echo'<div class="tab-pane fade" id="extracontent">';
echo"</div>"; /* EOL tab_extracontent */
echo'<div class="tab-pane fade" id="meta">';
echo"<div class='form-group'>
		<label class='control-label control-label-normal col-sm-2'>$lang[page_thumbnail]</label>
		<div class='col-sm-10'>";
echo "<option value=''>$lang[page_thumbnail]</option>";
echo"</select>";
echo"</div>
	 </div>";

echo"</fieldset>";

foreach($arr_Images as $page_thumbnails) {
		$selected = "";
		if($page_thumbnail == "$page_thumbnails") {
			$selected = "selected";
		}
		echo "<option $selected data-img-src='/content/iamages/$page_thumbnails' value='$page_thumbnails'>$page_thumbnails</option>";
}
		
echo'</div>'; /* EOL tab_meta */
echo'<div class="tab-pane fade" id="head">';
echo "<textarea name='page_head_styles' class='form-control aceEditor_css' rows='12'>$page_head_styles</textarea>";
echo "<textarea name='page_head_enhanced' class='form-control aceEditor_html' rows='12'>$page_head_enhanced</textarea>";
echo'</div>'; /* EOL tab_head */
echo'<div class="tab-pane fade" id="custom">';
echo'</div>'; /* EOL tab custom fields */
echo"</div>"; // EOL fancytabs
echo "<form action='$_SERVER[PHP_SELF]?tn=pages&sub=snippets' method='POST'>";
echo"<form action='$_SERVER[PHP_SELF]?tn=system&sub=stats' method='POST' class='form-inline'>";
echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=user&sub=groups" method="POST">';
echo '<form action="'.$_SERVER[PHP_SELF].'?tn=user&sub=groups" method="POST">';
echo "<form action='$_SERVER[PHP_SELF]?tn=user' class='form-inline' method='POST'>";
Fixed code: 
echo '<hr class="shadow" style="margin-top:0;">';

echo '<div class="panel panel-default">';

echo '<div class="panel-heading">Config</div>';
echo '<table class="table table-condensed">';
echo '<tr><td>Server:</td><td>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</td></tr>';
	echo '<tr><td>System E-Mails:</td><td>' . $prefs_mailer_adr . '</td></tr>';
	echo '<tr><td>System E-Mails:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
	echo '<tr><td>E-Mail Name:</td><td>' . $prefs_mailer_name . '</td></tr>';
	echo '<tr><td>E-Mail Name:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
echo '</table>';
echo '</div>';
echo '<div class="panel panel-default">';
echo '<div class="panel-heading">' . $lang['f_user_drm'] . '</div>';
echo '<div class="panel-body">';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_pages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_pages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editownpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editownpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_system'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user_can_publish'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user_can_publish'].'</li>';
echo '</div>';
echo '</div>';
echo '<form action="acp.php?tn=moduls&sub=t" method="POST" class="form-horizontal">';
echo '<form id="editpage" action="acp.php?tn=pages&sub=edit&editpage='.$editpage.'" class="form-horizontal" method="POST">';
echo '</div>'; /* EOL tab_info */
echo '<div class="tab-pane fade" id="content">';
echo '<div class="tab-pane fade" id="extracontent">';
echo '</div>'; /* EOL tab_extracontent */
echo '<div class="tab-pane fade" id="meta">';
echo '<div class="form-group">';
echo '<label class="control-label control-label-normal col-sm-2">'.$lang['page_thumbnail'].'</label>';
echo '<div class="col-sm-10">';
echo '<option value="">'.$lang['page_thumbnail'].'</option>';
echo '</select>';
echo '</div>';
echo '</div>';
echo '</fieldset>';
echo '</div>'; /* EOL tab_meta */
echo '<div class="tab-pane fade" id="head">';
echo '<textarea name="page_head_styles" class="form-control aceEditor_css" rows="12">'.$page_head_styles.'</textarea>';
echo '<textarea name="page_head_enhanced" class="form-control aceEditor_html" rows="12">'.$page_head_enhanced.'</textarea>';
echo '</div>'; /* EOL tab_head */
echo '<div class="tab-pane fade" id="custom">';
echo '</div>'; /* EOL tab custom fields */
echo '</div>'; // EOL fancytabs
echo "<form action='acp.php?tn=pages&sub=snippets' method='POST'>";
echo"<form action='acp.php?tn=system&sub=stats' method='POST' class='form-inline'>";
echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
echo "<form action='acp.php?tn=user' class='form-inline' method='POST'>";