CVE-2021-4121: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-16T08:15Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: Other
Files changed: config/version.php, layouts/basic/modules/Vtiger/Modals/MeetingModal.tpl
Commit date: 2021-12-15 07:54:00 +0100
Commit message: Improved MeetingUrl uitype

Diff: diff --git a/config/version.php b/config/version.php
index 4d254046b9b..6cf810d0af7 100644
--- a/config/version.php
+++ b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.3.7',
-	'patchVersion' => '2021.12.14',
+	'appVersion' => '6.3.8',
+	'patchVersion' => '2021.12.15',
 	'lib_roundcube' => '0.2.3',
 ];
diff --git a/layouts/basic/modules/Vtiger/Modals/MeetingModal.tpl b/layouts/basic/modules/Vtiger/Modals/MeetingModal.tpl
index 2967a5f7145..5f578e9c49a 100644
--- a/layouts/basic/modules/Vtiger/Modals/MeetingModal.tpl
+++ b/layouts/basic/modules/Vtiger/Modals/MeetingModal.tpl
@@ -10,20 +10,20 @@
 					</h6>
 					<div class="card-body text-center p-0">
 						<div class="row mb-3 mt-2">
 							<div class="col-xs-6 mx-auto">
 								<span class="m-1 u-fs-4x yfi-guest-link text-success js-clipboard u-cursor-pointer" data-js="click"
-									data-copy-attribute="clipboard-text" data-clipboard-text="{$MEETING_GUEST_URL}"
+									data-copy-attribute="clipboard-text" data-clipboard-text="{\App\Purifier::encodeHtml($MEETING_GUEST_URL)}"
 									title="{\App\Language::translate('BTN_COPY_TO_CLIPBOARD', $MODULE_NAME)}">
 								</span>
 								<div class="text-center text-success">
 									{\App\Language::translate('LBL_COPY', $MODULE_NAME)}
 								</div>
 							</div>
 							{if $SIMPLE_URL && !$MEETING_URL}
 								<div class="col-xs-6 mx-auto">
-									<a class="m-1 u-fs-4x yfi-enter-guest text-success" href="{$MEETING_GUEST_URL}" rel="noreferrer noopener" target="_blank"
+									<a class="m-1 u-fs-4x yfi-enter-guest text-success" href="{\App\Purifier::encodeHtml($MEETING_GUEST_URL)}" rel="noreferrer noopener" target="_blank"
 										title="{\App\Language::translate('LBL_MEETING_JOIN', $MODULE_NAME)}">
 									</a>
 									<div class="text-success">
 										{\App\Language::translate('LBL_MEETING_JOIN', $MODULE_NAME)}
 									</div>
@@ -66,11 +66,11 @@
 											{\App\Language::translate('LBL_SEND_MAIL', $MODULE_NAME)}
 										</div>
 									{else}
 										{assign var=URLDATA value=OSSMail_Module_Model::getExternalUrl($MODULE_NAME, $RECORD_ID, 'Detail', 'new')}
 										{if $URLDATA}
-											<a class="m-1 yfi-send-invitation text-info u-fs-4x" href="{$URLDATA}"
+											<a class="m-1 yfi-send-invitation text-info u-fs-4x" href="{\App\Purifier::encodeHtml($URLDATA)}"
 												title="{\App\Language::translate('LBL_MEETING_SEND_INVITATION', $MODULE_NAME)}">
 											</a>
 											<div class="text-center text-info">
 												{\App\Language::translate('LBL_SEND_MAIL', $MODULE_NAME)}
 											</div>
@@ -93,19 +93,19 @@
 						</h6>
 						<div class="card-body text-center p-0">
 							<div class="mb-3 mt-2 row">
 								<div class="col-xs-6 mx-auto">
 									<span class="m-1 u-fs-4x yfi-moderator-link text-danger js-clipboard u-cursor-pointer" data-js="click"
-										data-copy-attribute="clipboard-text" data-clipboard-text="{$MEETING_URL}"
+										data-copy-attribute="clipboard-text" data-clipboard-text="{\App\Purifier::encodeHtml($MEETING_URL)}"
 										title="{\App\Language::translate('BTN_COPY_TO_CLIPBOARD', $MODULE_NAME)}">
 									</span>
 									<div class="text-center text-danger">
 										{\App\Language::translate('LBL_COPY', $MODULE_NAME)}
 									</div>
 								</div>
 								<div class="col-xs-6 mx-auto">
-									<a class="m-1 u-fs-4x yfi-enter-moderator text-danger" href="{$MEETING_URL}" rel="noreferrer noopener" target="_blank"
+									<a class="m-1 u-fs-4x yfi-enter-moderator text-danger" href="{\App\Purifier::encodeHtml($MEETING_URL)}" rel="noreferrer noopener" target="_blank"
 										title="{\App\Language::translate('LBL_MEETING_JOIN', $MODULE_NAME)}">
 									</a>
 									<div class="text-danger">
 										{\App\Language::translate('LBL_MEETING_JOIN', $MODULE_NAME)}
 									</div>

Vulnerable code: 	'appVersion' => '6.3.7',
	'patchVersion' => '2021.12.14',
									data-copy-attribute="clipboard-text" data-clipboard-text="{$MEETING_GUEST_URL}"
									<a class="m-1 u-fs-4x yfi-enter-guest text-success" href="{$MEETING_GUEST_URL}" rel="noreferrer noopener" target="_blank"
											<a class="m-1 yfi-send-invitation text-info u-fs-4x" href="{$URLDATA}"
										data-copy-attribute="clipboard-text" data-clipboard-text="{$MEETING_URL}"
									<a class="m-1 u-fs-4x yfi-enter-moderator text-danger" href="{$MEETING_URL}" rel="noreferrer noopener" target="_blank"
Fixed code: 	'appVersion' => '6.3.8',
	'patchVersion' => '2021.12.15',
									data-copy-attribute="clipboard-text" data-clipboard-text="{\App\Purifier::encodeHtml($MEETING_GUEST_URL)}"
									<a class="m-1 u-fs-4x yfi-enter-guest text-success" href="{\App\Purifier::encodeHtml($MEETING_GUEST_URL)}" rel="noreferrer noopener" target="_blank"
											<a class="m-1 yfi-send-invitation text-info u-fs-4x" href="{\App\Purifier::encodeHtml($URLDATA)}"
										data-copy-attribute="clipboard-text" data-clipboard-text="{\App\Purifier::encodeHtml($MEETING_URL)}"
									<a class="m-1 u-fs-4x yfi-enter-moderator text-danger" href="{\App\Purifier::encodeHtml($MEETING_URL)}" rel="noreferrer noopener" target="_blank"