CVE-2022-3004: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-20T10:15Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: Other
Files changed: config/version.php, layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl, layouts/basic/modules/Settings/Workflows/CreateEntity.tpl, layouts/basic/modules/Settings/Workflows/EditTask.tpl, layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl, layouts/basic/modules/Settings/Workflows/ListViewContents.tpl, layouts/basic/modules/Settings/Workflows/ListViewHeader.tpl, layouts/basic/modules/Settings/Workflows/SortActionsModal.tpl, layouts/basic/modules/Settings/Workflows/Step1.tpl, layouts/basic/modules/Settings/Workflows/Step2.tpl, layouts/basic/modules/Settings/Workflows/Step3.tpl, layouts/basic/modules/Settings/Workflows/TasksList.tpl, modules/Settings/Workflows/actions/TaskAjax.php, modules/Settings/Workflows/views/EditTask.php
Commit date: 2022-08-26 10:36:12 +0200
Commit message: Improved worflow panel

Diff: diff --git a/config/version.php b/config/version.php
index f4083a384651..71fe910afca5 100644
--- a/config/version.php
+++ b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.4.13',
+	'appVersion' => '6.4.14',
 	'patchVersion' => '2022.08.26',
 	'lib_roundcube' => '0.3.1',
 ];
diff --git a/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl b/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl
index e3233b7dfe14..8d70c53cea88 100644
--- a/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl
+++ b/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl
@@ -4,11 +4,11 @@
 * ("License"); You may not use this file except in compliance with the License
 * The Original Code is:  vtiger CRM Open Source
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
-*
+* Contributor(s): YetiForce S.A.
 ********************************************************************************/
 -->*}
 {strip}
 	<div class="row js-conditions-row marginBottom10px align-items-center" data-js="container | clone">
 		<div class="col-md-4">
@@ -31,11 +31,11 @@
 							{if isset($CONDITION_INFO['value'])}
 								{assign var=FIELD_VALUE value=$CONDITION_INFO['value']}
 							{else}
 								{assign var=FIELD_VALUE value=""}
 							{/if}
-							<option value="{$FIELD_MODEL->$columnNameApi()}"
+							<option value="{$FIELD_MODEL->$columnNameApi()|escape}"
 								data-fieldtype="{$FIELD_MODEL->getFieldType()}" data-field-name="{$FIELD_NAME}"
 								{if !empty($CONDITION_INFO['columnname']) && App\Purifier::decodeHtml($FIELD_MODEL->$columnNameApi()) eq $CONDITION_INFO['columnname']}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
 									{assign var=SELECTED_FIELD_MODEL value=$FIELD_MODEL}
 									{$FIELD_INFO['value'] = App\Purifier::decodeHtml($FIELD_VALUE)}
@@ -71,19 +71,19 @@
 							{/if}>{if !empty($ADVANCED_FILTER_OPTIONS[$ADVANCE_FILTER_OPTION])}{\App\Language::translate($ADVANCED_FILTER_OPTIONS[$ADVANCE_FILTER_OPTION])}{/if}</option>
 					{/foreach}
 				</select>
 			</div>
 			<div class="col-md-4 fieldUiHolder">
-				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')}{/if}" data-value="value"
+				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')|escape}{/if}" data-value="value"
 					class="form-control" type="text"
 					value="{if !empty($CONDITION_INFO['value'])}{$CONDITION_INFO['value']|escape}{/if}" />
 			</div>
 			<span class="d-none">
 				{if empty($CONDITION)}
 					{assign var=CONDITION value="and"}
 				{/if}
-				<input type="hidden" name="column_condition" value="{$CONDITION}" />
+				<input type="hidden" name="column_condition" value="{$CONDITION|escape}" />
 			</span>
 			<span class="col-md-1">
 				<button class="btn btn-danger js-condition-delete" type="button" data-js="click">
 					<span class="fas fa-trash-alt" title="{\App\Language::translate('LBL_DELETE', $MODULE)}"></span>
 				</button>
diff --git a/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl b/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl
index 909001267e31..ded576d149a9 100644
--- a/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl
+++ b/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl
@@ -15,11 +15,11 @@
 	</h5>
 {/if}
 <input type="hidden" id="workflowModuleName" value="{$SOURCE_MODULE}">
 <input type="hidden" id="fieldValueMapping" name="field_value_mapping"
 	value="{if !empty($TASK_OBJECT->field_value_mapping)}{\App\Purifier::encodeHtml($TASK_OBJECT->field_value_mapping)}{/if}" />
-<input type="hidden" value="{$REFERENCE_FIELD_NAME}" name="reference_field" id="reference_field" />
+<input type="hidden" value="{$REFERENCE_FIELD_NAME|escape}" name="reference_field" id="reference_field" />
 <div class="js-conditions-container" id="save_fieldvaluemapping" data-js="container">
 	{if $RELATED_MODULE_MODEL_NAME neq ''}
 		<div>
 			<button type="button" class="btn btn-light"
 				id="addFieldBtn">{\App\Language::translate('LBL_ADD_FIELD',$QUALIFIED_MODULE)}</button>
@@ -40,27 +40,27 @@
 						{foreach from=$RELATED_MODULE_MODEL->getFields() item=FIELD_MODEL}
 							{if ($REFERENCE_FIELD_NAME eq $FIELD_MODEL->getName()) || !$FIELD_MODEL->isWritable()} {continue} {/if}
 							{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 							{if $FIELD_MODEL->getFieldDataType() == 'owner'}
 								{$SPECIAL_OPTION = [\App\Language::translate('LBL_SPECIAL_OPTIONS') => [
-																	'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
-																	'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
-																	]
-																]}
+												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
+												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
+												]
+											]}
 								{$FIELD_INFO['picklistvalues'] = array_merge($FIELD_INFO['picklistvalues'], $SPECIAL_OPTION)}
 							{/if}
-							<option value="{$FIELD_MODEL->getName()}"
+							<option value="{$FIELD_MODEL->getName()|escape}"
 								{if $FIELD_MAP['fieldname'] eq $FIELD_MODEL->getName()}
 									{assign var=MANDATORY_FIELD value=$FIELD_MODEL->isMandatory()}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
 									{assign var=IS_REFERENCE value=$FIELD_MODEL->isReferenceField()}
 									selected=""
 								{/if}
-								data-fieldtype="{$FIELD_MODEL->getFieldType()}"
-								data-field-name="{$FIELD_MODEL->getName()}"
+								data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
+								data-field-name="{$FIELD_MODEL->getName()|escape}"
 								data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-								data-reference="{$FIELD_MODEL->isReferenceField()}">
+								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 								{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL_NAME)}{if $FIELD_MODEL->isMandatory()}
 									<span class="redColor">*</span>
 								{/if}
 							</option>
 						{/foreach}
@@ -68,19 +68,19 @@
 				</div>
 				<div class="col-md-3">
 					<select name="modulename"
 						class="select2 form-control" {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist' || $IS_REFERENCE)} disabled="" {/if}>
 						<option {if $FIELD_MAP['modulename'] eq $SOURCE_MODULE} selected="" {/if}
-							value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
+							value="{$SOURCE_MODULE|escape}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
 						<option {if $FIELD_MAP['modulename'] eq {'destinyModule::'|cat:$RELATED_MODULE_MODEL_NAME} || ($FIELD_MAP['modulename'] eq $RELATED_MODULE_MODEL_NAME && $SOURCE_MODULE neq $RELATED_MODULE_MODEL_NAME)} selected="" {/if}
-							value="destinyModule::{$RELATED_MODULE_MODEL_NAME}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
+							value="destinyModule::{$RELATED_MODULE_MODEL_NAME|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
 					</select>
 				</div>
 				<div class="fieldUiHolder col-md-4">
 					<input type="text" class="getPopupUi form-control" readonly="" name="fieldValue"
-						value="{$FIELD_MAP['value']}" />
-					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']}" />
+						value="{$FIELD_MAP['value']|escape}" />
+					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']|escape}" />
 				</div>
 				{if $MANDATORY_FIELD neq true || $MAPPING_PANEL}
 					<button type="button" class="btn btn-danger js-condition-delete" data-js="click">
 						<span class="fas fa-trash-alt"></span>
 					</button>
@@ -111,26 +111,26 @@
 						{foreach from=$RELATED_MODULE_MODEL->getFields() item=FIELD_MODEL}
 							{if ($REFERENCE_FIELD_NAME eq $FIELD_MODEL->getName()) || !$FIELD_MODEL->isWritable()} {continue} {/if}
 							{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 							{if $FIELD_MODEL->getFieldDataType() == 'owner'}
 								{$SPECIAL_OPTION = [\App\Language::translate('LBL_SPECIAL_OPTIONS') => [
-														'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
-														'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
-														]
-													]}
+												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
+												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
+												]
+											]}
 								{$FIELD_INFO['picklistvalues'] = array_merge($FIELD_INFO['picklistvalues'], $SPECIAL_OPTION)}
 							{/if}
-							<option value="{$FIELD_MODEL->getName()}"
+							<option value="{$FIELD_MODEL->getName()|escape}"
 								data-fieldtype="{$FIELD_MODEL->getFieldType()}"
 								{if $FIELD_MODEL->getName() eq $MANDATORY_FIELD_MODEL->getName()}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
 									{assign var=IS_REFERENCE value=$FIELD_MODEL->isReferenceField()}
 									selected=""
 								{/if}
-								data-field-name="{$FIELD_MODEL->getName()}"
+								data-field-name="{$FIELD_MODEL->getName()|escape}"
 								data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-								data-reference="{$FIELD_MODEL->isReferenceField()}">
+								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 								{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL->getName())}
 								<span class="redColor">*</span>
 							</option>
 						{/foreach}
 					</select>
@@ -138,11 +138,11 @@
 				<span class="col-md-3">
 					<select name="modulename"
 						class="select2 form-control" {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist' || $IS_REFERENCE)} disabled="" {/if}>
 						<option value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
 						<option {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist')} selected="" {/if}
-							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
+							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
 					</select>
 				</span>
 				<span class="fieldUiHolder col-md-4">
 					<input type="text" class="getPopupUi form-control" name="fieldValue" value="" />
 					<input type="hidden" name="valuetype" value="rawtext" />
@@ -160,24 +160,24 @@
 				<option value="none">{\App\Language::translate('LBL_NONE',$QUALIFIED_MODULE)}</option>
 				{foreach from=$RELATED_MODULE_MODEL->getFields() item=FIELD_MODEL}
 					{if $REFERENCE_FIELD_NAME eq $FIELD_MODEL->getName()} {continue} {/if}
 					{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 					{if $FIELD_MODEL->isWritable() && ($MAPPING_PANEL || (!$FIELD_MODEL->isMandatory() && !$MAPPING_PANEL))}
-						<option value="{$FIELD_MODEL->getName()}" data-fieldtype="{$FIELD_MODEL->getFieldType()}"
-							data-field-name="{$FIELD_MODEL->getName()}"
+						<option value="{$FIELD_MODEL->getName()|escape}" data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
+							data-field-name="{$FIELD_MODEL->getName()|escape}"
 							data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-							data-reference="{$FIELD_MODEL->isReferenceField()}">
+							data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 							{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL_NAME)}
 						</option>
 					{/if}
 				{/foreach}
 			</select>
 		</div>
 		<div class="col-md-3">
 			<select name="modulename" class="form-control">
 				<option value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
-				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
+				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
 			</select>
 		</div>
 		<div class="fieldUiHolder col-md-4">
 			<input type="text" class="form-control" readonly="" name="fieldValue" value="" />
 			<input type="hidden" name="valuetype" value="rawtext" />
diff --git a/layouts/basic/modules/Settings/Workflows/EditTask.tpl b/layouts/basic/modules/Settings/Workflows/EditTask.tpl
index b6e5dbd20385..2b271766c735 100644
--- a/layouts/basic/modules/Settings/Workflows/EditTask.tpl
+++ b/layouts/basic/modules/Settings/Workflows/EditTask.tpl
@@ -19,28 +19,28 @@
 					<button type="button" class="close" data-dismiss="modal" aria-label="Close">
 						<span aria-hidden="true">&times;</span>
 					</button>
 				</div>
 				<form class="form-horizontal" id="saveTask" method="post" action="index.php">
-					<input type="hidden" name="module" value="{$MODULE}" />
+					<input type="hidden" name="module" value="{$MODULE|escape}" />
 					<input type="hidden" name="parent" value="Settings" />
 					<input type="hidden" name="action" value="TaskAjax" />
 					<input type="hidden" name="mode" value="save" />
 					<input type="hidden" name="for_workflow" value="{$WORKFLOW_ID}" />
 					<input type="hidden" name="task_id" value="{$TASK_ID}" />
-					<input type="hidden" name="taskType" id="taskType" value="{$TASK_TYPE_MODEL->get('tasktypename')}" />
+					<input type="hidden" name="taskType" id="taskType" value="{\App\Purifier::encodeHtml($TASK_TYPE_MODEL->get('tasktypename'))}" />
 					<div class="modal-body tabbable">
 						<div class="form-row pb-3">
 							<div class="col-md-2">
 								<div class="float-left col-form-label">{\App\Language::translate('LBL_TASK_TITLE',$QUALIFIED_MODULE)}
 									<span class="redColor">*</span>
 								</div>
 
 							</div>
 							<div class="col-md-5">
 								<input name="summary" class="form-control" data-validation-engine='validate[required]'
-									type="text" value="{$TASK_MODEL->get('summary')}" />
+									type="text" value="{\App\Purifier::encodeHtml($TASK_MODEL->get('summary'))}" />
 							</div>
 							<div class="col-md-4 form-control-plaintext">
 								<div class="float-left">{\App\Language::translate('LBL_STATUS',$QUALIFIED_MODULE)}</div>
 								<div class="float-left" id="taskStatus">
 									<input type="radio" name="active"
@@ -75,11 +75,11 @@
 								</div>
 								<div class="col-md-10 form-row {if !empty($TRIGGER)} show {else} d-none {/if}"
 									id="checkSelectDateContainer">
 									<div class="col-md-2">
 										<input class="form-control" type="text" name="select_date_days"
-											value="{if !empty($DAYS)}{$DAYS}{/if}"
+											value="{if !empty($DAYS)}{$DAYS|escape}{/if}"
 											data-validation-engine="validate[funcCall[Vtiger_WholeNumber_Validator_Js.invokeValidation]]">
 									</div>
 									<div class="col-form-label float-left alignMiddle">{\App\Language::translate('LBL_DAYS',$QUALIFIED_MODULE)}</div>
 									<div class="col-md-2 ml-0">
 										<select class="select2 form-control" name="select_date_direction">
@@ -91,11 +91,11 @@
 									</div>
 									<div class="col-md-6 ml-0">
 										<select class="select2" name="select_date_field">
 											{foreach from=$DATETIME_FIELDS item=DATETIME_FIELD}
 												<option {if !empty($TRIGGER['field']) && ($TRIGGER['field'] eq $DATETIME_FIELD->get('name'))} selected="" {/if}
-													value="{$DATETIME_FIELD->get('name')}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
+													value="{$DATETIME_FIELD->get('name')|escape}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
 											{/foreach}
 										</select>
 									</div>
 								</div>
 							</div>
diff --git a/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl b/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl
index 5ea0236de3cf..21b051f609a6 100644
--- a/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl
+++ b/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl
@@ -4,11 +4,11 @@
 * ("License"); You may not use this file except in compliance with the License
 * The Original Code is:  vtiger CRM Open Source
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
-*
+* Contributor(s): YetiForce S.A.
 ********************************************************************************/
 -->*}
 {strip}
 	<div class="popupUi modal fade" data-backdrop="false">
 		<div class="modal-dialog">
@@ -35,66 +35,72 @@
 									</option>
 								</optgroup>
 							</select>
 						</span>
 						<span class="col-md-4 d-none useFieldContainer">
-							<span name="{$MODULE_MODEL->get('name')}" class="useFieldElement">
+							<span name="{$MODULE_MODEL->get('name')|escape}" class="useFieldElement">
 								{assign var=MODULE_FIELDS value=$MODULE_MODEL->getFields()}
 								<select class="useField form-control"
-										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
+									data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
 									<option></option>
 									<optgroup>
 										{foreach from=$MODULE_FIELDS item=MODULE_FIELD}
-											<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
+											<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
 										{/foreach}
 									</optgroup>
 								</select>
 							</span>
 							{if !empty($RELATED_MODULE_MODEL)}
-								<span name="{$RELATED_MODULE_MODEL->get('name')}" class="useFieldElement">
+								<span name="{$RELATED_MODULE_MODEL->get('name')|escape}" class="useFieldElement">
 									{assign var=MODULE_FIELDS value=$RELATED_MODULE_MODEL->getFields()}
 									<select class="useField form-control"
-											data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
+										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
 										<option></option>
 										<optgroup>
 											{foreach from=$MODULE_FIELDS item=MODULE_FIELD}
-												<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
+												<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
 											{/foreach}
 										</optgroup>
 									</select>
 								</span>
 							{/if}
 						</span>
 						<span class="col-md-4 d-none useFunctionContainer">
 							<select class="useFunction form-control"
-									data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
+								data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
 								<option></option>
 								<optgroup>
 									{foreach from=$FIELD_EXPRESSIONS key=FIELD_EXPRESSION_VALUE item=FIELD_EXPRESSIONS_KEY}
-										<option value="{$FIELD_EXPRESSIONS_KEY}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
+										<option value="{$FIELD_EXPRESSIONS_KEY|escape}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
 									{/foreach}
 								</optgroup>
 							</select>
 						</span>
 					</div>
-					<br/>
+					<br />
 					<div class="fieldValueContainer">
 						<textarea data-textarea="true" class="fieldValue form-control"></textarea>
 					</div>
-					<br/>
+					<br />
 					<div id="rawtext_help" class="alert alert-info helpmessagebox d-none">
-						<p><h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>2000</p>
 						<p>{\App\Language::translate('LBL_VTIGER',$QUALIFIED_MODULE)}</p>
 					</div>
 					<div id="fieldname_help" class="helpmessagebox alert alert-info d-none">
-						<p><h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>{\App\Language::translate('LBL_ANNUAL_REVENUE',$QUALIFIED_MODULE)}</p>
 						<p>{\App\Language::translate('LBL_NOTIFY_OWNER',$QUALIFIED_MODULE)}</p>
 					</div>
 					<div id="expression_help" class="alert alert-info helpmessagebox d-none">
-						<p><h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>{\App\Language::translate('LBL_ANNUAL_REVENUE',$QUALIFIED_MODULE)}/12</p>
 						<p>{\App\Language::translate('LBL_EXPRESSION_EXAMPLE2',$QUALIFIED_MODULE)}</p>
 					</div>
 				</div>
 				<div class="modal-footer">
diff --git a/layouts/basic/modules/Settings/Workflows/LineItemsGroupTemplate.tpl b/layouts/basic/modules/Settings/Workflows/LineItemsGroupTemplate.tpl
deleted file mode 100644
index c7f32c87c759..000000000000
--- a/layouts/basic/modules/Settings/Workflows/LineItemsGroupTemplate.tpl
+++ /dev/null
@@ -1,112 +0,0 @@
-{*<!--
-/*********************************************************************************
-** The contents of this file are subject to the vtiger CRM Public License Version 1.0
-* ("License"); You may not use this file except in compliance with the License
-* The Original Code is:  vtiger CRM Open Source
-* The Initial Developer of the Original Code is vtiger.
-* Portions created by vtiger are Copyright (C) vtiger.
-* All Rights Reserved.
-*
-********************************************************************************/
--->*}
-
-{strip}
-	<div class="template-contents">
-		<table border=1 style="font-size:11px; width:100%; table-layout: fixed; border-collapse: collapse;">
-			<thead>
-                <tr bgcolor=#c0c0c0>
-                    <td style="text-align: center">
-                        <strong>Item Code</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Item Name</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Quantity</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>List Price</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Item Total</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Discount</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Total After Discount</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Total</strong>
-                    </td>
-                </tr>
-			</thead>
-			<tbody>
-                <!-- foreach item=LINEITEM from=$RECORD.LINEITEMS -->
-                <tr>
-                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.hdnProductcode} {/literal}   
-                    </td>
-                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.productName} {/literal}   
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.quantity} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.listprice} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.productTotal} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal}{$LINEITEM.discount_amount}{/literal}&nbsp;&nbsp;
-                        ({literal}{$LINEITEM.discount_percent}{/literal} %)
-                    </td>
-					<td align=left style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.totalAfterDiscount} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.netPrice} {/literal}
-                    </td>
-				</tr>
-				<!-- /foreach -->
-                <tr>
-                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Items Total</td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        {literal} {$RECORD.hdnSubTotal} {/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Discount({literal}{$RECORD.discount_percentage_final}{/literal}%)</td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        {literal}{$RECORD.discountTotal_final}{/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Pre Tax Total</td>
-                    <td style="text-align: right; word-wrap:  break-word;">
-						{literal}{$RECORD.pre_tax_total}{/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Tax({literal}{$RECORD.tax_totalpercent}{/literal})%</td>
-                    <td style="text-align: right; word-wrap: break-word;">
-						{literal}{$RECORD.tax_totalamount}{/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=7 style="word-wrap: break-word; text-align: right;">
-                        <span style="font-weight: bold">GRAND TOTAL</span>
-                        <strong style=" word-wrap: break-word;">
-                            ({literal}{$RECORD.currency_symbol}{/literal})
-                        </strong>
-                    </td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        <strong style=" word-wrap: break-word;">{literal}{$RECORD.hdnGrandTotal}{/literal}</strong>
-                    </td>
-				</tr>
-			</tbody>
-		</table>
-	</div>
-{/strip}               
diff --git a/layouts/basic/modules/Settings/Workflows/LineItemsIndividualTemplate.tpl b/layouts/basic/modules/Settings/Workflows/LineItemsIndividualTemplate.tpl
deleted file mode 100644
index 10b070a097f7..000000000000
--- a/layouts/basic/modules/Settings/Workflows/LineItemsIndividualTemplate.tpl
+++ /dev/null
@@ -1,113 +0,0 @@
-{*<!--
-/*********************************************************************************
-** The contents of this file are subject to the vtiger CRM Public License Version 1.0
-* ("License"); You may not use this file except in compliance with the License
-* The Original Code is:  vtiger CRM Open Source
-* The Initial Developer of the Original Code is vtiger.
-* Portions created by vtiger are Copyright (C) vtiger.
-* All Rights Reserved.
-*
-********************************************************************************/
--->*}
-
-{strip}
-	<div class="template-contents">
-		<table border=1 style="font-size:11px; width:100%; table-layout: fixed; border-collapse: collapse;">
-			<thead>
-                <tr bgcolor=#c0c0c0>
-                    <td style="text-align: center">
-                        <strong>Item Code</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Item Name</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Quantity</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>List Price</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Item Total</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Discount</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Total After Discount</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Tax</strong>
-                    </td>
-                    <td style="text-align: center">
-                        <strong>Total</strong>
-                    </td>
-                </tr>
-			</thead>
-			<tbody>
-                <!-- foreach item=LINEITEM from=$RECORD.LINEITEMS -->
-                <tr>
-                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.hdnProductcode} {/literal}   
-                    </td>
-                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.productName} {/literal}   
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.quantity} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.listprice} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.productTotal} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal}{$LINEITEM.discount_amount}{/literal}&nbsp;&nbsp;
-                        ({literal}{$LINEITEM.discount_percent}{/literal} %)
-                    </td>
-					<td align=left style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.totalAfterDiscount} {/literal}
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.taxTotal} {/literal}&nbsp; &nbsp;
-                        ({literal}{$LINEITEM.item_tax_totalpercent}{/literal} %)
-                    </td>
-                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
-                        {literal} {$LINEITEM.netPrice} {/literal}
-                    </td>
-				</tr>
-				<!-- /foreach -->
-                <tr>
-                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Items Total</td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        {literal} {$RECORD.hdnSubTotal} {/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Discount({literal}{$RECORD.discount_percentage_final}{/literal}%)</td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        {literal}{$RECORD.discountTotal_final}{/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Pre Tax Total</td>
-                    <td style="text-align: right; word-wrap:  break-word;">
-						{literal}{$RECORD.pre_tax_total}{/literal}
-                    </td>
-                </tr>
-                <tr>
-                    <td colspan=8 style="word-wrap: break-word; text-align: right;">
-                        <span style="font-weight: bold">GRAND TOTAL</span>
-                        <strong style=" word-wrap: break-word;">
-                            ({literal}{$RECORD.currency_symbol}{/literal})
-                        </strong>
-                    </td>
-                    <td style="text-align: right; word-wrap: break-word;">
-                        <strong style=" word-wrap: break-word;">{literal}{$RECORD.hdnGrandTotal}{/literal}</strong>
-                    </td>
-				</tr>
-			</tbody>
-		</table>
-	</div>
-{/strip}               
diff --git a/layouts/basic/modules/Settings/Workflows/ListViewContents.tpl b/layouts/basic/modules/Settings/Workflows/ListViewContents.tpl
index 23782ff29511..0d39347bfdce 100644
--- a/layouts/basic/modules/Settings/Workflows/ListViewContents.tpl
+++ b/layouts/basic/modules/Settings/Workflows/ListViewContents.tpl
@@ -13,12 +13,12 @@
 	<input type="hidden" id="pageStartRange" value="{$PAGING_MODEL->getRecordStartRange()}" />
 	<input type="hidden" id="pageEndRange" value="{$PAGING_MODEL->getRecordEndRange()}" />
 	<input type="hidden" id="previousPageExist" value="{$PAGING_MODEL->isPrevPageExists()}" />
 	<input type="hidden" id="nextPageExist" value="{$PAGING_MODEL->isNextPageExists()}" />
 	<input type="hidden" id="totalCount" value="{$LISTVIEW_COUNT}" />
-	<input type="hidden" value="{$ORDER_BY}" id="orderBy" />
-	<input type="hidden" value="{$SORT_ORDER}" id="sortOrder" />
+	<input type="hidden" value="{$ORDER_BY|escape}" id="orderBy" />
+	<input type="hidden" value="{$SORT_ORDER|escape}" id="sortOrder" />
 	<input type="hidden" id="totalCount" value="{$LISTVIEW_COUNT}" />
 	<input type='hidden' value="{$PAGE_NUMBER}" id='pageNumber'>
 	<input type='hidden' value="{$PAGING_MODEL->getPageLimit()}" id='pageLimit'>
 	<input type="hidden" value="{$LISTVIEW_ENTRIES_COUNT}" id="noOfEntries">
 
@@ -32,30 +32,30 @@
 			<thead>
 				<tr class="listViewHeaders">
 					{assign var=WIDTH value={99/(count($LISTVIEW_HEADERS))}}
 					{foreach item=LISTVIEW_HEADER from=$LISTVIEW_HEADERS}
 						<th nowrap class="{$WIDTHTYPE}">
-							<a {if !($LISTVIEW_HEADER->has('sort'))} class="listViewHeaderValues u-cursor-pointer js-listview_header" data-js="click" data-nextsortorderval="{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}{$NEXT_SORT_ORDER}{else}ASC{/if}" data-columnname="{$LISTVIEW_HEADER->get('name')}" {/if}>{\App\Language::translate($LISTVIEW_HEADER->get('label'), $QUALIFIED_MODULE)}
-								{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}&nbsp;&nbsp;<span class="{$SORT_IMAGE}"></span>{/if}</a>
+							<a {if !($LISTVIEW_HEADER->has('sort'))} class="listViewHeaderValues u-cursor-pointer js-listview_header" data-js="click" data-nextsortorderval="{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}{$NEXT_SORT_ORDER}{else}ASC{/if}" data-columnname="{$LISTVIEW_HEADER->get('name')|escape}" {/if}>{\App\Language::translate($LISTVIEW_HEADER->get('label'), $QUALIFIED_MODULE)}
+								{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}&nbsp;&nbsp;<span class="{$SORT_IMAGE|escape}"></span>{/if}</a>
 						</th>
 					{/foreach}
 					<th width='15%'></th>
 				</tr>
 			</thead>
 			<tbody>
 				{foreach item=LISTVIEW_ENTRY from=$LISTVIEW_ENTRIES}
 					<tr class="listViewEntries" data-id="{$LISTVIEW_ENTRY->getId()}"
-						{if method_exists($LISTVIEW_ENTRY,'getDetailViewUrl')}data-recordurl="{$LISTVIEW_ENTRY->getDetailViewUrl()}" {/if}>
+						{if method_exists($LISTVIEW_ENTRY,'getDetailViewUrl')}data-recordurl="{$LISTVIEW_ENTRY->getDetailViewUrl()|escape}" {/if}>
 						{foreach item=LISTVIEW_HEADER from=$LISTVIEW_HEADERS}
 							{assign var=LISTVIEW_HEADERNAME value=$LISTVIEW_HEADER->get('name')}
 							{if $LISTVIEW_HEADERNAME eq 'all_tasks'}
 								{assign var=ALL_TASKS value=$LISTVIEW_ENTRY->getDisplayValue($LISTVIEW_HEADERNAME)}
 							{else if $LISTVIEW_HEADERNAME eq 'active_tasks'}
 								{assign var=ACTIVE_TASKS value=$LISTVIEW_ENTRY->getDisplayValue($LISTVIEW_HEADERNAME)}
 							{/if}
 							{assign var=LAST_COLUMN value=$LISTVIEW_HEADER@last}
-							<td class="listViewEntryValue {$WIDTHTYPE}" data-name="{$LISTVIEW_HEADERNAME}">
+							<td class="listViewEntryValue {$WIDTHTYPE}" data-name="{$LISTVIEW_HEADERNAME|escape}">
 								&nbsp;{$LISTVIEW_ENTRY->getDisplayValue($LISTVIEW_HEADERNAME)}
 								{if $LAST_COLUMN && $LISTVIEW_ENTRY->getRecordLinks()}
 								</td>
 								<td class="{$WIDTHTYPE}">
 									<div class="float-right actions">
@@ -64,18 +64,18 @@
 												{assign var="RECORD_LINK_URL" value=$RECORD_LINK->getUrl()}
 												<a {if stripos($RECORD_LINK_URL, 'javascript:')===0}
 														onclick="{$RECORD_LINK_URL|substr:strlen("javascript:")};if (event.stopPropagation){ldelim}
 																event.stopPropagation();{rdelim} else{ldelim} event.cancelBubble = true;{rdelim}"
 													{else}
-														href='{$RECORD_LINK_URL}'
+														href='{$RECORD_LINK_URL|escape}'
 													{/if}
-												class="{$RECORD_LINK->get('class')}
+												class="{$RECORD_LINK->get('class')|escape}
 															{if ($RECORD_LINK->getLabel() eq 'LBL_ACTIVATION_TASKS' && $ACTIVE_TASKS eq $ALL_TASKS) ||
 																($RECORD_LINK->getLabel() eq 'LBL_DEACTIVATION_TASKS' && $ACTIVE_TASKS eq 0)}
 																{' '}d-none
 															{/if}">
-												<span class="{$RECORD_LINK->getIcon()}" title="{\App\Language::translate($RECORD_LINK->getLabel(), $QUALIFIED_MODULE)}"></span>
+												<span class="{$RECORD_LINK->getIcon()|escape}" title="{\App\Language::translate($RECORD_LINK->getLabel(), $QUALIFIED_MODULE)}"></span>
 											</a>
 											{if !$RECORD_LINK@last}
 												&nbsp;&nbsp;
 											{/if}
 										{/foreach}
diff --git a/layouts/basic/modules/Settings/Workflows/ListViewHeader.tpl b/layouts/basic/modules/Settings/Workflows/ListViewHeader.tpl
index 6b08eb50754b..e0513ff70c01 100644
--- a/layouts/basic/modules/Settings/Workflows/ListViewHeader.tpl
+++ b/layouts/basic/modules/Settings/Workflows/ListViewHeader.tpl
@@ -39,17 +39,17 @@
 				</div>
 			</div>
 			<div class="listViewActionsDi row my-2">
 				<div class="col-lg-4 btn-toolbar d-flex justify-content-between justify-content-lg-start">
 					<button class="btn btn-success addButton" {if stripos($MODULE_MODEL->getCreateViewUrl(), 'javascript:')===0} onclick="{$MODULE_MODEL->getCreateViewUrl()|substr:strlen('javascript:')};"
-						{else} onclick='window.location.href = "{$MODULE_MODEL->getCreateViewUrl()}"'
+						{else} onclick='window.location.href = "{$MODULE_MODEL->getCreateViewUrl()|escape}"'
 						{/if}>
 						<i class="fas fa-plus"></i>&nbsp;
 						<strong>{\App\Language::translate('LBL_NEW', $QUALIFIED_MODULE)} {\App\Language::translate('LBL_WORKFLOW',$QUALIFIED_MODULE)}</strong>
 					</button>
 					<button class="btn btn-outline-secondary ml-1 importButton" id="importButton"
-						data-url="{Settings_Workflows_Module_Model::getImportViewUrl()}"
+						data-url="{Settings_Workflows_Module_Model::getImportViewUrl()|escape}"
 						title="{\App\Language::translate('LBL_IMPORT_TEMPLATE', $QUALIFIED_MODULE)}">
 						<i class="fas fa-download"></i>
 					</button>
 					<button class="btn btn-info ml-1 js-workflow-sort-button {if empty($SOURCE_MODULE)}d-none{/if}"
 						title="{\App\Language::translate('LBL_SORTING_SETTINGS', $QUALIFIED_MODULE)}">
@@ -59,11 +59,11 @@
 				<div class="col-lg-3 btn-toolbar ml-0 mt-1 mt-lg-0">
 					<select class="select2 form-control js-workflow-module-filter" id="moduleFilter">
 						<option value="">{\App\Language::translate('LBL_ALL', $QUALIFIED_MODULE)}</option>
 						{foreach item=MODULE_MODEL key=TAB_ID from=$SUPPORTED_MODULE_MODELS}
 							<option {if !empty($SOURCE_MODULE) && $SOURCE_MODULE eq $MODULE_MODEL->getName()} selected="" {/if}
-								value="{$MODULE_MODEL->getName()}">
+								value="{$MODULE_MODEL->getName()|escape}">
 								{\App\Language::translate($MODULE_MODEL->getName(),$MODULE_MODEL->getName())}
 							</option>
 						{/foreach}
 					</select>
 				</div>
diff --git a/layouts/basic/modules/Settings/Workflows/SortActionsModal.tpl b/layouts/basic/modules/Settings/Workflows/SortActionsModal.tpl
index f94c4e18cd08..c30b81e10daa 100644
--- a/layouts/basic/modules/Settings/Workflows/SortActionsModal.tpl
+++ b/layouts/basic/modules/Settings/Workflows/SortActionsModal.tpl
@@ -5,19 +5,19 @@
 		{if $WORKFLOW_ACTIONS}
 			<div class="form-group">
 				{App\Language::translate('LBL_SELECT_WORKFLOW', $QUALIFIED_MODULE)}<br />
 				<select class="select2 form-control js-workflow-for-sort" data-js="value">
 					{foreach key=WORKFLOW_ID item=ACTION from=$WORKFLOW_ACTIONS}
-						<option value="{$WORKFLOW_ID}">{$ACTION['summary']}</option>
+						<option value="{$WORKFLOW_ID}">{\App\Purifier::encodeHtml($ACTION['summary'])}</option>
 					{/foreach}
 				</select>
 			</div>
 			<div class="form-group">
 				{App\Language::translate('LBL_SET_WORKFLOW_BEFORE', $QUALIFIED_MODULE)}<br />
 				<select class="select2 form-control js-workflow-before" data-js="value">
 					{foreach key=WORKFLOW_ID item=ACTION from=$WORKFLOW_ACTIONS}
-						<option value="{$WORKFLOW_ID}">{$ACTION['summary']}</option>
+						<option value="{$WORKFLOW_ID}">{\App\Purifier::encodeHtml($ACTION['summary'])}</option>
 					{/foreach}
 				</select>
 			</div>
 		{/if}
 	</div>
diff --git a/layouts/basic/modules/Settings/Workflows/Step1.tpl b/layouts/basic/modules/Settings/Workflows/Step1.tpl
index f1dfb9e3ab47..90ca8ec6529b 100644
--- a/layouts/basic/modules/Settings/Workflows/Step1.tpl
+++ b/layouts/basic/modules/Settings/Workflows/Step1.tpl
@@ -3,42 +3,43 @@
 * ("License"); You may not use this file except in compliance with the License
 * The Original Code is:  vtiger CRM Open Source
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
+* Contributor(s): YetiForce S.A.
 *************************************************************************************}
 {strip}
 	<div class="tpl-Settings-Workflows-Step1 workFlowContents">
 		<form name="EditWorkflow" action="index.php" method="post" id="workflow_step1" class="form-horizontal">
 			<input type="hidden" name="module" value="Workflows">
 			<input type="hidden" name="view" value="Edit">
-			<input type="hidden" name="mode" value="Step2"/>
-			<input type="hidden" name="parent" value="Settings"/>
-			<input type="hidden" class="step" value="1"/>
-			<input type="hidden" name="record" value="{$RECORDID}"/>
-			<input type="hidden" id="weekStartDay" data-value='{$WEEK_START_ID}'/>
+			<input type="hidden" name="mode" value="Step2" />
+			<input type="hidden" name="parent" value="Settings" />
+			<input type="hidden" class="step" value="1" />
+			<input type="hidden" name="record" value="{$RECORDID}" />
+			<input type="hidden" id="weekStartDay" data-value='{$WEEK_START_ID|escape}' />
 
 			<div class="u-p-1per border">
 				<label>
 					<strong>{\App\Language::translate('LBL_STEP_1',$QUALIFIED_MODULE)}
 						: {\App\Language::translate('LBL_ENTER_BASIC_DETAILS_OF_THE_WORKFLOW',$QUALIFIED_MODULE)}</strong>
 				</label>
-				<br/>
+				<br />
 				<div class="form-group form-row">
 					<label class="col-sm-3 col-form-label u-text-small-bold text-right">
 						{\App\Language::translate('LBL_SELECT_MODULE', $QUALIFIED_MODULE)}
 					</label>
 					<div class="col-sm-6 controls">
 						{if isset($MODE) && $MODE eq 'edit'}
 							<input type='text' disabled='disabled' class="form-control"
-								   value="{\App\Language::translate($MODULE_MODEL->getName(), $MODULE_MODEL->getName())}">
-							<input type='hidden' name='module_name' value="{$MODULE_MODEL->get('name')}">
+								value="{\App\Language::translate($MODULE_MODEL->getName(), $MODULE_MODEL->getName())}">
+							<input type='hidden' name='module_name' value="{$MODULE_MODEL->get('name')|escape}">
 						{else}
 							<select class="select2 form-control" id="moduleName" name="module_name" required="true"
-									data-placeholder="Select Module...">
+								data-placeholder="Select Module...">
 								{foreach from=$ALL_MODULES key=TABID item=MODULE_MODEL}
-									<option value="{$MODULE_MODEL->getName()}" {if isset($SELECTED_MODULE) && $SELECTED_MODULE == $MODULE_MODEL->getName()} selected {/if}>
+									<option value="{$MODULE_MODEL->getName()|escape}" {if isset($SELECTED_MODULE) && $SELECTED_MODULE == $MODULE_MODEL->getName()} selected {/if}>
 										{\App\Language::translate($MODULE_MODEL->getName(), $MODULE_MODEL->getName())}
 									</option>
 								{/foreach}
 							</select>
 						{/if}
@@ -48,12 +49,12 @@
 					<label class="col-sm-3 col-form-label u-text-small-bold text-right">
 						{\App\Language::translate('LBL_DESCRIPTION', $QUALIFIED_MODULE)}<span class="redColor">*</span>
 					</label>
 					<div class="col-sm-6 controls">
 						<input type="text" name="summary" class="form-control"
-							   data-validation-engine='validate[required]' value="{$WORKFLOW_MODEL->get('summary')}"
-							   id="summary"/>
+							data-validation-engine='validate[required]' value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('summary'))}"
+							id="summary" />
 					</div>
 				</div>
 				<div class="form-group form-row">
 					<label class="col-sm-3 col-form-label u-text-small-bold text-right">
 						{\App\Language::translate('LBL_SPECIFY_WHEN_TO_EXECUTE', $QUALIFIED_MODULE)}
@@ -63,13 +64,13 @@
 						{foreach from=$TRIGGER_TYPES item=LABEL key=LABEL_ID}
 							{assign var=EXECUTION_CONDITION value=$WORKFLOW_MODEL_OBJ->executionCondition}
 							<div class="js-wf-execution-container" data-js="container">
 								<label>
 									<input type="radio" class="alignTop"
-										name="execution_condition" {if $EXECUTION_CONDITION eq $LABEL_ID} checked="checked" {/if}	value="{$LABEL_ID}"/>
+										name="execution_condition" {if $EXECUTION_CONDITION eq $LABEL_ID} checked="checked" {/if} value="{$LABEL_ID|escape}" />
 									&nbsp;&nbsp;{\App\Language::translate($LABEL,$QUALIFIED_MODULE)}
-								</label><br/>
+								</label><br />
 								{assign var=PARAMS value=[]}
 								{if !empty($WORKFLOW_MODEL_OBJ->params)}
 									{assign var=PARAMS value=\App\Json::decode($WORKFLOW_MODEL_OBJ->params)}
 								{/if}
 								{if $LABEL_ID eq 8}
@@ -96,11 +97,11 @@
 							</div>
 						{/foreach}
 					</div>
 				</div>
 			</div>
-			<br/>
+			<br />
 			<div class="float-right mb-4">
 				<button class="btn btn-success mr-1" type="submit" disabled="disabled">
 					<strong>
 						<span class="fas fa-caret-right mr-1"></span>
 						{\App\Language::translate('LBL_NEXT', $QUALIFIED_MODULE)}
diff --git a/layouts/basic/modules/Settings/Workflows/Step2.tpl b/layouts/basic/modules/Settings/Workflows/Step2.tpl
index 9ab9e70c29d4..d85896e05bfb 100644
--- a/layouts/basic/modules/Settings/Workflows/Step2.tpl
+++ b/layouts/basic/modules/Settings/Workflows/Step2.tpl
@@ -3,36 +3,37 @@
 * ("License"); You may not use this file except in compliance with the License
 * The Original Code is:  vtiger CRM Open Source
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
+* Contributor(s): YetiForce S.A.
 *************************************************************************************}
 {strip}
 	<form name="EditWorkflow" action="index.php" method="post" id="workflow_step2"
-		  class="tpl-Settings-Workflows-Step2 form-horizontal">
-		<input type="hidden" name="module" value="Workflows"/>
-		<input type="hidden" name="action" value="Save"/>
-		<input type="hidden" name="parent" value="Settings"/>
-		<input type="hidden" class="step" value="2"/>
-		<input type="hidden" name="summary" value="{$WORKFLOW_MODEL->get('summary')}"/>
-		<input type="hidden" name="record" value="{$WORKFLOW_MODEL->get('record')}"/>
-		<input type="hidden" name="module_name" value="{$WORKFLOW_MODEL->get('module_name')}"/>
-		<input type="hidden" name="execution_condition" value="{$WORKFLOW_MODEL->get('execution_condition')}"/>
-		<input type="hidden" name="conditions" id="advanced_filter" value=''/>
+		class="tpl-Settings-Workflows-Step2 form-horizontal">
+		<input type="hidden" name="module" value="Workflows" />
+		<input type="hidden" name="action" value="Save" />
+		<input type="hidden" name="parent" value="Settings" />
+		<input type="hidden" class="step" value="2" />
+		<input type="hidden" name="summary" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('summary'))}" />
+		<input type="hidden" name="record" value="{$WORKFLOW_MODEL->get('record')|escape}" />
+		<input type="hidden" name="module_name" value="{$WORKFLOW_MODEL->get('module_name')|escape}" />
+		<input type="hidden" name="execution_condition" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('execution_condition'))}" />
+		<input type="hidden" name="conditions" id="advanced_filter" value='' />
 		<input type="hidden" id="olderConditions"
-			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('conditions')))}"/>
-		<input type="hidden" name="filtersavedinnew" value="{$WORKFLOW_MODEL->get('filtersavedinnew')}"/>
-		<input type="hidden" name="schtypeid" value="{$WORKFLOW_MODEL->get('schtypeid')}"/>
-		<input type="hidden" name="schtime" value="{$WORKFLOW_MODEL->get('schtime')}"/>
-		<input type="hidden" name="schdate" value="{$WORKFLOW_MODEL->get('schdate')}"/>
-		<input type="hidden" name="params" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('params'))}"/>
+			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('conditions')))}" />
+		<input type="hidden" name="filtersavedinnew" value="{$WORKFLOW_MODEL->get('filtersavedinnew')|escape}" />
+		<input type="hidden" name="schtypeid" value="{$WORKFLOW_MODEL->get('schtypeid')|escape}" />
+		<input type="hidden" name="schtime" value="{$WORKFLOW_MODEL->get('schtime')|escape}" />
+		<input type="hidden" name="schdate" value="{$WORKFLOW_MODEL->get('schdate')|escape}" />
+		<input type="hidden" name="params" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('params'))}" />
 		<input type="hidden" name="schdayofweek"
-			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofweek')))}"/>
+			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofweek')))}" />
 		<input type="hidden" name="schdayofmonth"
-			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofmonth')))}"/>
+			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofmonth')))}" />
 		<input type="hidden" name="schannualdates"
-			   value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('schannualdates'))}"/>
+			value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('schannualdates'))}" />
 		{if $WORKFLOW_MODEL->get('execution_condition') eq \VTWorkflowManager::$ON_SCHEDULE && $WORKFLOW_MODEL->getParams('iterationOff')}
 			<div class="alert alert-info">
 				{\App\Language::translate('LBL_WORKFLOW_RESTRICTION_OFF_ALERT',$QUALIFIED_MODULE)}
 			</div>
 		{else}
@@ -40,30 +41,31 @@
 				{if $IS_FILTER_SAVED_NEW == false}
 					<div class="alert alert-info">
 						{\App\Language::translate('LBL_CREATED_IN_OLD_LOOK_CANNOT_BE_EDITED',$QUALIFIED_MODULE)}
 					</div>
 					<div class="">
-						<span class="col-md-6"><input type="radio" name="conditionstype" class="alignMiddle" checked=""/>&nbsp;&nbsp;<span
-									class="alignMiddle">{\App\Language::translate('LBL_USE_EXISTING_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
+						<span class="col-md-6"><input type="radio" name="conditionstype" class="alignMiddle" checked="" />&nbsp;&nbsp;<span
+								class="alignMiddle">{\App\Language::translate('LBL_USE_EXISTING_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
 						<span class="col-md-6"><input type="radio" id="enableAdvanceFilters" name="conditionstype"
-													class="alignMiddle recreate"/>&nbsp;&nbsp;<span
-									class="alignMiddle">{\App\Language::translate('LBL_RECREATE_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
+								class="alignMiddle recreate" />&nbsp;&nbsp;<span
+								class="alignMiddle">{\App\Language::translate('LBL_RECREATE_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
 					</div>
-					<br/>
+					<br />
 				{/if}
 				<div id="advanceFilterContainer" {if $IS_FILTER_SAVED_NEW == false} class="zeroOpacity js-conditions-container padding1per" {else} class="row js-conditions-container padding1per" {/if}
 					data-js="container">
 					<h5 class="padding-bottom1per col-md-10">
-						<strong>{\App\Language::translate('LBL_CHOOSE_FILTER_CONDITIONS',$MODULE)}</strong></h5>
+						<strong>{\App\Language::translate('LBL_CHOOSE_FILTER_CONDITIONS',$MODULE)}</strong>
+					</h5>
 					<div class="col-md-10">
 						{include file=\App\Layout::getTemplatePath('AdvanceFilter.tpl') RECORD_STRUCTURE=$RECORD_STRUCTURE}
 					</div>
 					{include file=\App\Layout::getTemplatePath('FieldExpressions.tpl', $QUALIFIED_MODULE) EXECUTION_CONDITION=$WORKFLOW_MODEL->get('execution_condition')}
 				</div>
 			</div>
 		{/if}
-		<br/>
+		<br />
 		<div class="float-right">
 			<button class="btn btn-secondary backStep mr-1" type="button">
 				<strong>
 					<span class="fas fa-caret-left mr-1"></span>
 					{\App\Language::translate('LBL_BACK', $QUALIFIED_MODULE)}
@@ -80,8 +82,8 @@
 					<span class="fas fa-times mr-1"></span>
 					{\App\Language::translate('LBL_CANCEL', $QUALIFIED_MODULE)}
 				</strong>
 			</button>
 		</div>
-		<br/><br/>
+		<br /><br />
 	</form>
 {/strip}
diff --git a/layouts/basic/modules/Settings/Workflows/Step3.tpl b/layouts/basic/modules/Settings/Workflows/Step3.tpl
index 7621d32d2f58..66745edd6779 100644
--- a/layouts/basic/modules/Settings/Workflows/Step3.tpl
+++ b/layouts/basic/modules/Settings/Workflows/Step3.tpl
@@ -3,32 +3,33 @@
 * ("License"); You may not use this file except in compliance with the License
 * The Original Code is:  vtiger CRM Open Source
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
+* Contributor(s): YetiForce S.A.
 *************************************************************************************}
 {strip}
 	<form name="EditWorkflow" action="index.php" method="post" id="workflow_step3" class="tpl-Settings-Workflows-Step3 form-horizontal">
-		<input type="hidden" name="module" value="Workflows"/>
-		<input type="hidden" name="record" value="{$RECORD}"/>
-		<input type="hidden" class="step" value="3"/>
+		<input type="hidden" name="module" value="Workflows" />
+		<input type="hidden" name="record" value="{$RECORD}" />
+		<input type="hidden" class="step" value="3" />
 		<div class="btn-group">
 			<a class="btn dropdown-toggle btn-light addButton" data-toggle="dropdown" href="#">
 				<strong>{\App\Language::translate('LBL_ADD_TASK',$QUALIFIED_MODULE)}</strong>&nbsp;
 			</a>
 			<ul class="dropdown-menu">
 				{foreach from=$TASK_RECORDS item=TASK_RECORD}
 					<li><a class="u-cursor-pointer dropdown-item"
-						   data-url="{$TASK_RECORD->getEditViewUrl()}">{\App\Language::translate($TASK_RECORD->getTaskType()->get('label'), $QUALIFIED_MODULE)}</a>
+							data-url="{$TASK_RECORD->getEditViewUrl()|escape}">{\App\Language::translate($TASK_RECORD->getTaskType()->get('label'), $QUALIFIED_MODULE)}</a>
 					</li>
 				{/foreach}
 			</ul>
 		</div>
 		<div id="taskListContainer">
 			{include file=\App\Layout::getTemplatePath('TasksList.tpl', $QUALIFIED_MODULE)}
 		</div>
-		<br/>
+		<br />
 		<div class="float-right">
 			<button class="btn btn-secondary backStep mr-1" type="button">
 				<strong>
 					<span class="fas fa-caret-left mr-1"></span>
 					{\App\Language::translate('LBL_BACK', $QUALIFIED_MODULE)}
diff --git a/layouts/basic/modules/Settings/Workflows/TasksList.tpl b/layouts/basic/modules/Settings/Workflows/TasksList.tpl
index 528f0f9180cd..30be09af66ae 100644
--- a/layouts/basic/modules/Settings/Workflows/TasksList.tpl
+++ b/layouts/basic/modules/Settings/Workflows/TasksList.tpl
@@ -20,26 +20,26 @@
 			</thead>
 			<tbody>
 				{foreach from=$TASK_LIST item=TASK}
 					<tr class="listViewEntries js-workflow-task" data-id="{$TASK->getId()}">
 						<td width="10%">
-							<a class="px-2 u-cursor-move js-drag" data-js="ui-sortable-handle"><img class="align-baseline" src="{\App\Layout::getImagePath('drag.png')}" title="{\App\Language::translate('LBL_DRAG',$QUALIFIED_MODULE)}" /></a> <input type="checkbox" class="taskStatus" data-statusurl="{$TASK->getChangeStatusUrl()}" {if $TASK->isActive()} checked="" {/if} />
+							<a class="px-2 u-cursor-move js-drag" data-js="ui-sortable-handle"><img class="align-baseline" src="{\App\Layout::getImagePath('drag.png')}" title="{\App\Language::translate('LBL_DRAG',$QUALIFIED_MODULE)}" /></a> <input type="checkbox" class="taskStatus" data-statusurl="{$TASK->getChangeStatusUrl()|escape}" {if $TASK->isActive()} checked="" {/if} />
 						</td>
 						<td width="30%">{\App\Language::translate($TASK->getTaskType()->getLabel(),$QUALIFIED_MODULE)}</td>
-						<td width="60%">{$TASK->getName()}
+						<td width="60%">{\App\Purifier::encodeHtml($TASK->getName())}
 							<div class="float-right actions">
 								<span class="actionImages">
 									{if $TASK->isEditable()}
-										<a data-url="{$TASK->getEditViewUrl()}">
+										<a data-url="{$TASK->getEditViewUrl()|escape}">
 											<span class="yfi yfi-full-editing-view" title="{\App\Language::translate('LBL_EDIT',$QUALIFIED_MODULE)}"></span>
 										</a>&nbsp;&nbsp;
 									{else}
 										<div class="js-popover-tooltip mr-2 d-inline text-danger" data-js="popover" data-content="{\App\Purifier::encodeHtml(App\Language::translate('LBL_ERROR_DELETE_ENTRY', $QUALIFIED_MODULE))}">
 											<span class="fas fa-info-circle"></span>
 										</div>
 									{/if}
-									<a class="deleteTask" data-deleteurl="{$TASK->getDeleteActionUrl()}">
+									<a class="deleteTask" data-deleteurl="{$TASK->getDeleteActionUrl()|escape}">
 										<span class="fas fa-trash-alt" title="{\App\Language::translate('LBL_DELETE',$QUALIFIED_MODULE)}"></span>
 									</a>
 								</span>
 							</div>
 						</td>
diff --git a/modules/Settings/Workflows/actions/TaskAjax.php b/modules/Settings/Workflows/actions/TaskAjax.php
index 5871ce9e254c..a735784008f8 100644
--- a/modules/Settings/Workflows/actions/TaskAjax.php
+++ b/modules/Settings/Workflows/actions/TaskAjax.php
@@ -94,23 +94,23 @@ class Settings_Workflows_TaskAjax_Action extends Settings_Vtiger_Basic_Action
 	 *
 	 * @return void
 	 */
 	public function save(App\Request $request)
 	{
-		$workflowId = $request->get('for_workflow');
+		$workflowId = !$request->isEmpty('for_workflow') ? $request->getInteger('for_workflow') : 0;
 		if (!empty($workflowId)) {
-			$record = $request->get('task_id');
+			$record = !$request->isEmpty('task_id') ? $request->getInteger('task_id') : 0;
 			if ($record) {
 				$taskRecordModel = Settings_Workflows_TaskRecord_Model::getInstance($record);
 				$taskObject = $taskRecordModel->getTaskObject();
 			} else {
 				$workflowModel = Settings_Workflows_Record_Model::getInstance($workflowId);
 				$taskRecordModel = Settings_Workflows_TaskRecord_Model::getCleanInstance($workflowModel, $request->get('taskType'));
 				$taskObject = $taskRecordModel->getTaskObject();
 				$taskObject->sequence = $taskRecordModel->getNextSequenceNumber($workflowId);
 			}
-			$taskObject->summary = htmlspecialchars($request->get('summary'));
+			$taskObject->summary = \App\Purifier::decodeHtml($request->getByType('summary', \App\Purifier::TEXT));
 
 			$active = $request->get('active');
 			if ('true' == $active) {
 				$taskObject->active = true;
 			} elseif ('false' == $active) {
@@ -119,11 +119,11 @@ class Settings_Workflows_TaskAjax_Action extends Settings_Vtiger_Basic_Action
 			$checkSelectDate = $request->get('check_select_date');
 
 			if (!empty($checkSelectDate)) {
 				$trigger = [
 					'days' => ('after' == $request->get('select_date_direction') ? 1 : -1) * (int) $request->get('select_date_days'),
-					'field' => $request->get('select_date_field'),
+					'field' => $request->getByType('select_date_field', \App\Purifier::ALNUM),
 				];
 				$taskObject->trigger = $trigger;
 			} else {
 				$taskObject->trigger = null;
 			}
@@ -141,11 +141,11 @@ class Settings_Workflows_TaskAjax_Action extends Settings_Vtiger_Basic_Action
 								$values[$index]['value'] = htmlspecialchars($value['value']);
 							}
 
 							$taskObject->{$fieldName} = \App\Json::encode($values);
 						} else {
-							$taskObject->{$fieldName} = $request->getRaw($fieldName);
+							$taskObject->{$fieldName} = \App\Purifier::decodeHtml($request->getByType($fieldName, \App\Purifier::TEXT));
 						}
 					} elseif (isset($fieldNamesRequestMethods[$fieldName])) {
 						$taskObject->{$fieldName} = $request->{$fieldNamesRequestMethods[$fieldName]}($fieldName);
 					} else {
 						$taskObject->{$fieldName} = $request->get($fieldName);
diff --git a/modules/Settings/Workflows/views/EditTask.php b/modules/Settings/Workflows/views/EditTask.php
index 0e3894d06ba9..b516477f3b99 100644
--- a/modules/Settings/Workflows/views/EditTask.php
+++ b/modules/Settings/Workflows/views/EditTask.php
@@ -127,23 +127,11 @@ class Settings_Workflows_EditTask_View extends Settings_Vtiger_Index_View
 		$viewer->assign('WORKFLOW_ID', $workflowId);
 		$viewer->assign('DATETIME_FIELDS', $dateTimeFields);
 		$viewer->assign('WORKFLOW_MODEL', $workflowModel);
 		$viewer->assign('TASK_MODEL', $taskModel);
 		$viewer->assign('CURRENTDATE', date('Y-n-j'));
-		// Adding option Line Item block for Individual tax mode
-		$individualTaxBlockLabel = \App\Language::translate('LBL_LINEITEM_BLOCK_GROUP', $qualifiedModuleName);
-		$individualTaxBlockValue = $viewer->view('LineItemsGroupTemplate.tpl', $qualifiedModuleName, true);
 
-		// Adding option Line Item block for group tax mode
-		$groupTaxBlockLabel = \App\Language::translate('LBL_LINEITEM_BLOCK_INDIVIDUAL', $qualifiedModuleName);
-		$groupTaxBlockValue = $viewer->view('LineItemsIndividualTemplate.tpl', $qualifiedModuleName, true);
-
-		$templateVariables = [
-			$individualTaxBlockValue => $individualTaxBlockLabel,
-			$groupTaxBlockValue => $groupTaxBlockLabel,
-		];
-		$viewer->assign('TEMPLATE_VARIABLES', $templateVariables);
 		$viewer->assign('TASK_OBJECT', $taskObject);
 		$viewer->assign('FIELD_EXPRESSIONS', Settings_Workflows_Module_Model::getExpressions());
 		$userModel = \App\User::getCurrentUserModel();
 		$viewer->assign('dateFormat', $userModel->getDetail('date_format'));
 		$viewer->assign('timeFormat', $userModel->getDetail('hour_format'));

Vulnerable code: 	'appVersion' => '6.4.13',
*
							<option value="{$FIELD_MODEL->$columnNameApi()}"
				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')}{/if}" data-value="value"
				<input type="hidden" name="column_condition" value="{$CONDITION}" />
<input type="hidden" value="{$REFERENCE_FIELD_NAME}" name="reference_field" id="reference_field" />
																	'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
																	'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
																	]
																]}
							<option value="{$FIELD_MODEL->getName()}"
								data-fieldtype="{$FIELD_MODEL->getFieldType()}"
								data-field-name="{$FIELD_MODEL->getName()}"
								data-reference="{$FIELD_MODEL->isReferenceField()}">
							value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
							value="destinyModule::{$RELATED_MODULE_MODEL_NAME}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
						value="{$FIELD_MAP['value']}" />
					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']}" />
														'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
														'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
														]
													]}
							<option value="{$FIELD_MODEL->getName()}"
								data-field-name="{$FIELD_MODEL->getName()}"
								data-reference="{$FIELD_MODEL->isReferenceField()}">
							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
						<option value="{$FIELD_MODEL->getName()}" data-fieldtype="{$FIELD_MODEL->getFieldType()}"
							data-field-name="{$FIELD_MODEL->getName()}"
							data-reference="{$FIELD_MODEL->isReferenceField()}">
				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
					<input type="hidden" name="module" value="{$MODULE}" />
					<input type="hidden" name="taskType" id="taskType" value="{$TASK_TYPE_MODEL->get('tasktypename')}" />
									type="text" value="{$TASK_MODEL->get('summary')}" />
											value="{if !empty($DAYS)}{$DAYS}{/if}"
													value="{$DATETIME_FIELD->get('name')}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
*
							<span name="{$MODULE_MODEL->get('name')}" class="useFieldElement">
										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
											<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
								<span name="{$RELATED_MODULE_MODEL->get('name')}" class="useFieldElement">
											data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
												<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
									data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
										<option value="{$FIELD_EXPRESSIONS_KEY}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
					<br/>
					<br/>
						<p><h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5></p>
						<p><h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5></p>
						<p><h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5></p>
{*<!--
/*********************************************************************************
** The contents of this file are subject to the vtiger CRM Public License Version 1.0
* ("License"); You may not use this file except in compliance with the License
* The Original Code is:  vtiger CRM Open Source
* The Initial Developer of the Original Code is vtiger.
* Portions created by vtiger are Copyright (C) vtiger.
* All Rights Reserved.
*
********************************************************************************/

{strip}
	<div class="template-contents">
		<table border=1 style="font-size:11px; width:100%; table-layout: fixed; border-collapse: collapse;">
			<thead>
                <tr bgcolor=#c0c0c0>
                    <td style="text-align: center">
                        <strong>Item Code</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Item Name</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Quantity</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>List Price</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Item Total</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Discount</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Total After Discount</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Total</strong>
                    </td>
                </tr>
			</thead>
			<tbody>
                <!-- foreach item=LINEITEM from=$RECORD.LINEITEMS -->
                <tr>
                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.hdnProductcode} {/literal}   
                    </td>
                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.productName} {/literal}   
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.quantity} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.listprice} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.productTotal} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal}{$LINEITEM.discount_amount}{/literal}&nbsp;&nbsp;
                        ({literal}{$LINEITEM.discount_percent}{/literal} %)
                    </td>
					<td align=left style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.totalAfterDiscount} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.netPrice} {/literal}
                    </td>
				</tr>
				<!-- /foreach -->
                <tr>
                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Items Total</td>
                    <td style="text-align: right; word-wrap: break-word;">
                        {literal} {$RECORD.hdnSubTotal} {/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Discount({literal}{$RECORD.discount_percentage_final}{/literal}%)</td>
                    <td style="text-align: right; word-wrap: break-word;">
                        {literal}{$RECORD.discountTotal_final}{/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Pre Tax Total</td>
                    <td style="text-align: right; word-wrap:  break-word;">
						{literal}{$RECORD.pre_tax_total}{/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=7 style="word-wrap: break-word; text-align: right;">Tax({literal}{$RECORD.tax_totalpercent}{/literal})%</td>
                    <td style="text-align: right; word-wrap: break-word;">
						{literal}{$RECORD.tax_totalamount}{/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=7 style="word-wrap: break-word; text-align: right;">
                        <span style="font-weight: bold">GRAND TOTAL</span>
                        <strong style=" word-wrap: break-word;">
                            ({literal}{$RECORD.currency_symbol}{/literal})
                        </strong>
                    </td>
                    <td style="text-align: right; word-wrap: break-word;">
                        <strong style=" word-wrap: break-word;">{literal}{$RECORD.hdnGrandTotal}{/literal}</strong>
                    </td>
				</tr>
			</tbody>
		</table>
	</div>
{/strip}               
{*<!--
/*********************************************************************************
** The contents of this file are subject to the vtiger CRM Public License Version 1.0
* ("License"); You may not use this file except in compliance with the License
* The Original Code is:  vtiger CRM Open Source
* The Initial Developer of the Original Code is vtiger.
* Portions created by vtiger are Copyright (C) vtiger.
* All Rights Reserved.
*
********************************************************************************/

{strip}
	<div class="template-contents">
		<table border=1 style="font-size:11px; width:100%; table-layout: fixed; border-collapse: collapse;">
			<thead>
                <tr bgcolor=#c0c0c0>
                    <td style="text-align: center">
                        <strong>Item Code</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Item Name</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Quantity</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>List Price</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Item Total</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Discount</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Total After Discount</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Tax</strong>
                    </td>
                    <td style="text-align: center">
                        <strong>Total</strong>
                    </td>
                </tr>
			</thead>
			<tbody>
                <!-- foreach item=LINEITEM from=$RECORD.LINEITEMS -->
                <tr>
                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.hdnProductcode} {/literal}   
                    </td>
                    <td align=right style="text-align: center; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.productName} {/literal}   
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.quantity} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.listprice} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.productTotal} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal}{$LINEITEM.discount_amount}{/literal}&nbsp;&nbsp;
                        ({literal}{$LINEITEM.discount_percent}{/literal} %)
                    </td>
					<td align=left style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.totalAfterDiscount} {/literal}
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.taxTotal} {/literal}&nbsp; &nbsp;
                        ({literal}{$LINEITEM.item_tax_totalpercent}{/literal} %)
                    </td>
                    <td align=right style="text-align: right; vertical-align : top; word-wrap: break-word;">
                        {literal} {$LINEITEM.netPrice} {/literal}
                    </td>
				</tr>
				<!-- /foreach -->
                <tr>
                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Items Total</td>
                    <td style="text-align: right; word-wrap: break-word;">
                        {literal} {$RECORD.hdnSubTotal} {/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Discount({literal}{$RECORD.discount_percentage_final}{/literal}%)</td>
                    <td style="text-align: right; word-wrap: break-word;">
                        {literal}{$RECORD.discountTotal_final}{/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=8 style="word-wrap: break-word; text-align: right;">Pre Tax Total</td>
                    <td style="text-align: right; word-wrap:  break-word;">
						{literal}{$RECORD.pre_tax_total}{/literal}
                    </td>
                </tr>
                <tr>
                    <td colspan=8 style="word-wrap: break-word; text-align: right;">
                        <span style="font-weight: bold">GRAND TOTAL</span>
                        <strong style=" word-wrap: break-word;">
                            ({literal}{$RECORD.currency_symbol}{/literal})
                        </strong>
                    </td>
                    <td style="text-align: right; word-wrap: break-word;">
                        <strong style=" word-wrap: break-word;">{literal}{$RECORD.hdnGrandTotal}{/literal}</strong>
                    </td>
				</tr>
			</tbody>
		</table>
	</div>
{/strip}               
	<input type="hidden" value="{$ORDER_BY}" id="orderBy" />
	<input type="hidden" value="{$SORT_ORDER}" id="sortOrder" />
							<a {if !($LISTVIEW_HEADER->has('sort'))} class="listViewHeaderValues u-cursor-pointer js-listview_header" data-js="click" data-nextsortorderval="{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}{$NEXT_SORT_ORDER}{else}ASC{/if}" data-columnname="{$LISTVIEW_HEADER->get('name')}" {/if}>{\App\Language::translate($LISTVIEW_HEADER->get('label'), $QUALIFIED_MODULE)}
								{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}&nbsp;&nbsp;<span class="{$SORT_IMAGE}"></span>{/if}</a>
						{if method_exists($LISTVIEW_ENTRY,'getDetailViewUrl')}data-recordurl="{$LISTVIEW_ENTRY->getDetailViewUrl()}" {/if}>
							<td class="listViewEntryValue {$WIDTHTYPE}" data-name="{$LISTVIEW_HEADERNAME}">
														href='{$RECORD_LINK_URL}'
												class="{$RECORD_LINK->get('class')}
												<span class="{$RECORD_LINK->getIcon()}" title="{\App\Language::translate($RECORD_LINK->getLabel(), $QUALIFIED_MODULE)}"></span>
						{else} onclick='window.location.href = "{$MODULE_MODEL->getCreateViewUrl()}"'
						data-url="{Settings_Workflows_Module_Model::getImportViewUrl()}"
								value="{$MODULE_MODEL->getName()}">
						<option value="{$WORKFLOW_ID}">{$ACTION['summary']}</option>
						<option value="{$WORKFLOW_ID}">{$ACTION['summary']}</option>
			<input type="hidden" name="mode" value="Step2"/>
			<input type="hidden" name="parent" value="Settings"/>
			<input type="hidden" class="step" value="1"/>
			<input type="hidden" name="record" value="{$RECORDID}"/>
			<input type="hidden" id="weekStartDay" data-value='{$WEEK_START_ID}'/>
				<br/>
								   value="{\App\Language::translate($MODULE_MODEL->getName(), $MODULE_MODEL->getName())}">
							<input type='hidden' name='module_name' value="{$MODULE_MODEL->get('name')}">
									data-placeholder="Select Module...">
									<option value="{$MODULE_MODEL->getName()}" {if isset($SELECTED_MODULE) && $SELECTED_MODULE == $MODULE_MODEL->getName()} selected {/if}>
							   data-validation-engine='validate[required]' value="{$WORKFLOW_MODEL->get('summary')}"
							   id="summary"/>
										name="execution_condition" {if $EXECUTION_CONDITION eq $LABEL_ID} checked="checked" {/if}	value="{$LABEL_ID}"/>
								</label><br/>
			<br/>
		  class="tpl-Settings-Workflows-Step2 form-horizontal">
		<input type="hidden" name="module" value="Workflows"/>
		<input type="hidden" name="action" value="Save"/>
		<input type="hidden" name="parent" value="Settings"/>
		<input type="hidden" class="step" value="2"/>
		<input type="hidden" name="summary" value="{$WORKFLOW_MODEL->get('summary')}"/>
		<input type="hidden" name="record" value="{$WORKFLOW_MODEL->get('record')}"/>
		<input type="hidden" name="module_name" value="{$WORKFLOW_MODEL->get('module_name')}"/>
		<input type="hidden" name="execution_condition" value="{$WORKFLOW_MODEL->get('execution_condition')}"/>
		<input type="hidden" name="conditions" id="advanced_filter" value=''/>
			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('conditions')))}"/>
		<input type="hidden" name="filtersavedinnew" value="{$WORKFLOW_MODEL->get('filtersavedinnew')}"/>
		<input type="hidden" name="schtypeid" value="{$WORKFLOW_MODEL->get('schtypeid')}"/>
		<input type="hidden" name="schtime" value="{$WORKFLOW_MODEL->get('schtime')}"/>
		<input type="hidden" name="schdate" value="{$WORKFLOW_MODEL->get('schdate')}"/>
		<input type="hidden" name="params" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('params'))}"/>
			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofweek')))}"/>
			   value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofmonth')))}"/>
			   value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('schannualdates'))}"/>
						<span class="col-md-6"><input type="radio" name="conditionstype" class="alignMiddle" checked=""/>&nbsp;&nbsp;<span
									class="alignMiddle">{\App\Language::translate('LBL_USE_EXISTING_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
													class="alignMiddle recreate"/>&nbsp;&nbsp;<span
									class="alignMiddle">{\App\Language::translate('LBL_RECREATE_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
					<br/>
						<strong>{\App\Language::translate('LBL_CHOOSE_FILTER_CONDITIONS',$MODULE)}</strong></h5>
		<br/>
		<br/><br/>
		<input type="hidden" name="module" value="Workflows"/>
		<input type="hidden" name="record" value="{$RECORD}"/>
		<input type="hidden" class="step" value="3"/>
						   data-url="{$TASK_RECORD->getEditViewUrl()}">{\App\Language::translate($TASK_RECORD->getTaskType()->get('label'), $QUALIFIED_MODULE)}</a>
		<br/>
							<a class="px-2 u-cursor-move js-drag" data-js="ui-sortable-handle"><img class="align-baseline" src="{\App\Layout::getImagePath('drag.png')}" title="{\App\Language::translate('LBL_DRAG',$QUALIFIED_MODULE)}" /></a> <input type="checkbox" class="taskStatus" data-statusurl="{$TASK->getChangeStatusUrl()}" {if $TASK->isActive()} checked="" {/if} />
						<td width="60%">{$TASK->getName()}
										<a data-url="{$TASK->getEditViewUrl()}">
									<a class="deleteTask" data-deleteurl="{$TASK->getDeleteActionUrl()}">
		$workflowId = $request->get('for_workflow');
			$record = $request->get('task_id');
			$taskObject->summary = htmlspecialchars($request->get('summary'));
					'field' => $request->get('select_date_field'),
							$taskObject->{$fieldName} = $request->getRaw($fieldName);
		// Adding option Line Item block for Individual tax mode
		$individualTaxBlockLabel = \App\Language::translate('LBL_LINEITEM_BLOCK_GROUP', $qualifiedModuleName);
		$individualTaxBlockValue = $viewer->view('LineItemsGroupTemplate.tpl', $qualifiedModuleName, true);
		// Adding option Line Item block for group tax mode
		$groupTaxBlockLabel = \App\Language::translate('LBL_LINEITEM_BLOCK_INDIVIDUAL', $qualifiedModuleName);
		$groupTaxBlockValue = $viewer->view('LineItemsIndividualTemplate.tpl', $qualifiedModuleName, true);

		$templateVariables = [
			$individualTaxBlockValue => $individualTaxBlockLabel,
			$groupTaxBlockValue => $groupTaxBlockLabel,
		];
		$viewer->assign('TEMPLATE_VARIABLES', $templateVariables);
Fixed code: 	'appVersion' => '6.4.14',
* Contributor(s): YetiForce S.A.
							<option value="{$FIELD_MODEL->$columnNameApi()|escape}"
				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')|escape}{/if}" data-value="value"
				<input type="hidden" name="column_condition" value="{$CONDITION|escape}" />
<input type="hidden" value="{$REFERENCE_FIELD_NAME|escape}" name="reference_field" id="reference_field" />
												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
												]
											]}
							<option value="{$FIELD_MODEL->getName()|escape}"
								data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
								data-field-name="{$FIELD_MODEL->getName()|escape}"
								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
							value="{$SOURCE_MODULE|escape}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
							value="destinyModule::{$RELATED_MODULE_MODEL_NAME|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
						value="{$FIELD_MAP['value']|escape}" />
					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']|escape}" />
												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
												]
											]}
							<option value="{$FIELD_MODEL->getName()|escape}"
								data-field-name="{$FIELD_MODEL->getName()|escape}"
								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
						<option value="{$FIELD_MODEL->getName()|escape}" data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
							data-field-name="{$FIELD_MODEL->getName()|escape}"
							data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
					<input type="hidden" name="module" value="{$MODULE|escape}" />
					<input type="hidden" name="taskType" id="taskType" value="{\App\Purifier::encodeHtml($TASK_TYPE_MODEL->get('tasktypename'))}" />
									type="text" value="{\App\Purifier::encodeHtml($TASK_MODEL->get('summary'))}" />
											value="{if !empty($DAYS)}{$DAYS|escape}{/if}"
													value="{$DATETIME_FIELD->get('name')|escape}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
* Contributor(s): YetiForce S.A.
							<span name="{$MODULE_MODEL->get('name')|escape}" class="useFieldElement">
									data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
											<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
								<span name="{$RELATED_MODULE_MODEL->get('name')|escape}" class="useFieldElement">
										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
												<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
								data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
										<option value="{$FIELD_EXPRESSIONS_KEY|escape}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
					<br />
					<br />
						<p>
						<h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5>
						</p>
						<p>
						<h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5>
						</p>
						<p>
						<h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5>
						</p>
	<input type="hidden" value="{$ORDER_BY|escape}" id="orderBy" />
	<input type="hidden" value="{$SORT_ORDER|escape}" id="sortOrder" />
							<a {if !($LISTVIEW_HEADER->has('sort'))} class="listViewHeaderValues u-cursor-pointer js-listview_header" data-js="click" data-nextsortorderval="{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}{$NEXT_SORT_ORDER}{else}ASC{/if}" data-columnname="{$LISTVIEW_HEADER->get('name')|escape}" {/if}>{\App\Language::translate($LISTVIEW_HEADER->get('label'), $QUALIFIED_MODULE)}
								{if $COLUMN_NAME eq $LISTVIEW_HEADER->get('name')}&nbsp;&nbsp;<span class="{$SORT_IMAGE|escape}"></span>{/if}</a>
						{if method_exists($LISTVIEW_ENTRY,'getDetailViewUrl')}data-recordurl="{$LISTVIEW_ENTRY->getDetailViewUrl()|escape}" {/if}>
							<td class="listViewEntryValue {$WIDTHTYPE}" data-name="{$LISTVIEW_HEADERNAME|escape}">
														href='{$RECORD_LINK_URL|escape}'
												class="{$RECORD_LINK->get('class')|escape}
												<span class="{$RECORD_LINK->getIcon()|escape}" title="{\App\Language::translate($RECORD_LINK->getLabel(), $QUALIFIED_MODULE)}"></span>
						{else} onclick='window.location.href = "{$MODULE_MODEL->getCreateViewUrl()|escape}"'
						data-url="{Settings_Workflows_Module_Model::getImportViewUrl()|escape}"
								value="{$MODULE_MODEL->getName()|escape}">
						<option value="{$WORKFLOW_ID}">{\App\Purifier::encodeHtml($ACTION['summary'])}</option>
						<option value="{$WORKFLOW_ID}">{\App\Purifier::encodeHtml($ACTION['summary'])}</option>
* Contributor(s): YetiForce S.A.
			<input type="hidden" name="mode" value="Step2" />
			<input type="hidden" name="parent" value="Settings" />
			<input type="hidden" class="step" value="1" />
			<input type="hidden" name="record" value="{$RECORDID}" />
			<input type="hidden" id="weekStartDay" data-value='{$WEEK_START_ID|escape}' />
				<br />
								value="{\App\Language::translate($MODULE_MODEL->getName(), $MODULE_MODEL->getName())}">
							<input type='hidden' name='module_name' value="{$MODULE_MODEL->get('name')|escape}">
								data-placeholder="Select Module...">
									<option value="{$MODULE_MODEL->getName()|escape}" {if isset($SELECTED_MODULE) && $SELECTED_MODULE == $MODULE_MODEL->getName()} selected {/if}>
							data-validation-engine='validate[required]' value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('summary'))}"
							id="summary" />
										name="execution_condition" {if $EXECUTION_CONDITION eq $LABEL_ID} checked="checked" {/if} value="{$LABEL_ID|escape}" />
								</label><br />
			<br />
* Contributor(s): YetiForce S.A.
		class="tpl-Settings-Workflows-Step2 form-horizontal">
		<input type="hidden" name="module" value="Workflows" />
		<input type="hidden" name="action" value="Save" />
		<input type="hidden" name="parent" value="Settings" />
		<input type="hidden" class="step" value="2" />
		<input type="hidden" name="summary" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('summary'))}" />
		<input type="hidden" name="record" value="{$WORKFLOW_MODEL->get('record')|escape}" />
		<input type="hidden" name="module_name" value="{$WORKFLOW_MODEL->get('module_name')|escape}" />
		<input type="hidden" name="execution_condition" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('execution_condition'))}" />
		<input type="hidden" name="conditions" id="advanced_filter" value='' />
			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('conditions')))}" />
		<input type="hidden" name="filtersavedinnew" value="{$WORKFLOW_MODEL->get('filtersavedinnew')|escape}" />
		<input type="hidden" name="schtypeid" value="{$WORKFLOW_MODEL->get('schtypeid')|escape}" />
		<input type="hidden" name="schtime" value="{$WORKFLOW_MODEL->get('schtime')|escape}" />
		<input type="hidden" name="schdate" value="{$WORKFLOW_MODEL->get('schdate')|escape}" />
		<input type="hidden" name="params" value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('params'))}" />
			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofweek')))}" />
			value="{\App\Purifier::encodeHtml(\App\Json::encode($WORKFLOW_MODEL->get('schdayofmonth')))}" />
			value="{\App\Purifier::encodeHtml($WORKFLOW_MODEL->get('schannualdates'))}" />
						<span class="col-md-6"><input type="radio" name="conditionstype" class="alignMiddle" checked="" />&nbsp;&nbsp;<span
								class="alignMiddle">{\App\Language::translate('LBL_USE_EXISTING_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
								class="alignMiddle recreate" />&nbsp;&nbsp;<span
								class="alignMiddle">{\App\Language::translate('LBL_RECREATE_CONDITIONS',$QUALIFIED_MODULE)}</span></span>
					<br />
						<strong>{\App\Language::translate('LBL_CHOOSE_FILTER_CONDITIONS',$MODULE)}</strong>
					</h5>
		<br />
		<br /><br />
* Contributor(s): YetiForce S.A.
		<input type="hidden" name="module" value="Workflows" />
		<input type="hidden" name="record" value="{$RECORD}" />
		<input type="hidden" class="step" value="3" />
							data-url="{$TASK_RECORD->getEditViewUrl()|escape}">{\App\Language::translate($TASK_RECORD->getTaskType()->get('label'), $QUALIFIED_MODULE)}</a>
		<br />
							<a class="px-2 u-cursor-move js-drag" data-js="ui-sortable-handle"><img class="align-baseline" src="{\App\Layout::getImagePath('drag.png')}" title="{\App\Language::translate('LBL_DRAG',$QUALIFIED_MODULE)}" /></a> <input type="checkbox" class="taskStatus" data-statusurl="{$TASK->getChangeStatusUrl()|escape}" {if $TASK->isActive()} checked="" {/if} />
						<td width="60%">{\App\Purifier::encodeHtml($TASK->getName())}
										<a data-url="{$TASK->getEditViewUrl()|escape}">
									<a class="deleteTask" data-deleteurl="{$TASK->getDeleteActionUrl()|escape}">
		$workflowId = !$request->isEmpty('for_workflow') ? $request->getInteger('for_workflow') : 0;
			$record = !$request->isEmpty('task_id') ? $request->getInteger('task_id') : 0;
			$taskObject->summary = \App\Purifier::decodeHtml($request->getByType('summary', \App\Purifier::TEXT));
					'field' => $request->getByType('select_date_field', \App\Purifier::ALNUM),
							$taskObject->{$fieldName} = \App\Purifier::decodeHtml($request->getByType($fieldName, \App\Purifier::TEXT));