CVE-2020-13797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-06-03T22:15Z
Repository: https://github.com/NavigateCMS/Navigate-CMS
Language: PHP
Files changed: lib/packages/feeds/feed.class.php, lib/packages/menus/menu.class.php, lib/packages/menus/menus.php, lib/packages/structure/structure.class.php, lib/packages/websites/website.class.php
Commit date: 2020-05-17 16:16:05 +0200
Commit message: + HTML Purify some fields to prevent XSS attacks

Diff: diff --git a/lib/packages/feeds/feed.class.php b/lib/packages/feeds/feed.class.php
index 7a9759768..695bae4f8 100644
--- a/lib/packages/feeds/feed.class.php
+++ b/lib/packages/feeds/feed.class.php
@@ -50,10 +50,12 @@ class feed
 		$this->paths 		= path::loadElementPaths('feed', $this->id);
 	}
 	
 	public function load_from_post()
 	{
+	    global $purifier;
+
 		$this->permission	= intval($_REQUEST['permission']);
 		$this->enabled		= intval($_REQUEST['enabled']);
 		$this->format  		= $_REQUEST['format'];
 		$this->image		= intval($_REQUEST['image']);
 		$this->content 		= $_REQUEST['content'];
@@ -65,35 +67,46 @@ class feed
 		$this->paths = array();
 		$fields = array('title', 'description');
 		
 		foreach($_REQUEST as $key => $value)
 		{
-			if(empty($value)) continue;
+			if(empty($value))
+            {
+                continue;
+            }
 			
 			foreach($fields as $field)
 			{
 				if(substr($key, 0, strlen($field.'-'))==$field.'-')
-					$this->dictionary[substr($key, strlen($field.'-'))][$field] = $value;
+                {
+                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $purifier->purify($value);
+                }
 			}
 		
 			if(substr($key, 0, strlen('path-'))=='path-')
-				$this->paths[substr($key, strlen('path-'))] = $value;
+            {
+                $this->paths[substr($key, strlen('path-'))] = $purifier->purify($value);
+            }
 		}	
 		
 		$this->categories 	= '';
 		if($_REQUEST['categories']!='true')
-			$this->categories	= explode(',', $_REQUEST['categories']);				
+        {
+            $this->categories	= explode(',', $_REQUEST['categories']);
+        }
 	}
 
 	public function save()
 	{
-		global $DB;
-
 		if(!empty($this->id))
-			return $this->update();
+        {
+            return $this->update();
+        }
 		else
-			return $this->insert();			
+        {
+            return $this->insert();
+        }
 	}
 	
 	public function delete()
 	{
 		global $DB;
@@ -157,11 +170,13 @@ class feed
 				'enabled' => value_or_default($this->enabled, 0)
 			)
 		);
 
         if(!$ok)
+        {
             throw new Exception($DB->get_last_error());
+        }
 
 		$this->id = $DB->get_last_id();
 			
 		webdictionary::save_element_strings('feed', $this->id, $this->dictionary);
 		path::saveElementPaths('feed', $this->id, $this->paths);
@@ -206,11 +221,13 @@ class feed
 				'enabled' => value_or_default($this->enabled, 0)
 			)
 		);
 							  
 		if(!$ok)
-		    throw new Exception($DB->get_last_error());
+        {
+            throw new Exception($DB->get_last_error());
+        }
 		
 		webdictionary::save_element_strings('feed', $this->id, $this->dictionary);
 		path::saveElementPaths('feed', $this->id, $this->paths);
 
         if(method_exists($events, 'trigger'))
@@ -246,11 +263,13 @@ class feed
 		
 		// all columns to look for	
 		$cols[] = 'i.id' . $like;
 
 		if(!empty($dict_ids))
-			$cols[] = 'i.id IN ('.implode(',', $dict_ids).')';
+        {
+            $cols[] = 'i.id IN ('.implode(',', $dict_ids).')';
+        }
 			
 		$where = ' AND ( ';	
 		$where.= implode( ' OR ', $cols); 
 		$where .= ')';
 		
@@ -262,19 +281,23 @@ class feed
 		global $current;
 		global $website;
 		global $DB;
 	
 		if(empty($id))
-			$id = $current['id'];
+        {
+            $id = $current['id'];
+        }
 
 		$item = new feed();
 		$item->load($id);
 		
 		$permission = nvweb_object_enabled($item);
 	
 		if(!$permission)
+        {
             return;
+        }
 
         $feed = new UniversalFeedCreator();
 		
 		$feed->encoding = 'UTF-8';
 		$feed->title = $item->dictionary[$current['lang']]['title'];
@@ -294,11 +317,14 @@ class feed
 
 		// TODO: include products in feed content
 		if(!empty($item->categories[0]))
 		{			
 			$limit = intval($item->entries);		 
-			if($limit <= 0)	$limit = 10;
+			if($limit <= 0)
+            {
+                $limit = 10;
+            }
 
             $DB->query(' SELECT SQL_CALC_FOUND_ROWS i.id, i.permission, i.date_published, i.date_unpublish,
                                 i.date_to_display, COALESCE(NULLIF(i.date_to_display, 0), i.date_created) as pdate, d.text as title, i.position as position,
                                 i.galleries as galleries, i.template as template
                           FROM nv_items i, nv_structure s, nv_webdictionary d
@@ -378,11 +404,13 @@ class feed
                     if(!empty($rs[$x]->galleries))
                     {
                         $galleries = mb_unserialize($rs[$x]->galleries);
                         $photo = @array_shift(array_keys($galleries[0]));
                         if(!empty($photo))
+                        {
                             $image = $website->absolute_path(false) . '/object?type=image&id='.$photo;
+                        }
                     }
 
                     if(empty($image))
                     {
                         // no image found on galleries, look for image properties
@@ -391,36 +419,46 @@ class feed
                         for($p=0; $p < count($properties); $p++)
                         {
                             if($properties[$p]->type=='image')
                             {
                                 if(!empty($properties[$p]->value))
+                                {
                                     $image = $properties[$p]->value;
+                                }
                                 else if(!empty($properties[$p]->dvalue))
+                                {
                                     $image = $properties[$p]->dvalue;
+                                }
 
                                 if(is_array($image))
                                 {
                                     $image = array_values($image);
                                     $image = $image[0];
                                 }
 
                                 if(!empty($image))
+                                {
                                     $image = $website->absolute_path(false) . '/object?type=image&id='.$image;
+                                }
                             }
 
                             // we only need the first image
                             if(!empty($image))
+                            {
                                 break;
+                            }
                         }
                     }
 
                     if(!empty($image))
                     {
                         $fitem->image = $image;
 	                    // feedly will only display images of >450px --> http://blog.feedly.com/2015/07/31/10-ways-to-optimize-your-feed-for-feedly/
 						if(strpos($item->format, 'RSS')!==false)
-							$fitem->description = '<img src="'.$image.'&width=640"><br />'.$fitem->description;
+                        {
+                            $fitem->description = '<img src="'.$image.'&width=640"><br />'.$fitem->description;
+                        }
 					}
 
 					//$item->author = $contents->rows[$x]->author_name;
 					$feed->addItem($fitem); 			
 				}
@@ -458,11 +496,13 @@ class feed
 
         $DB->query('SELECT * FROM nv_feeds WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
+        {
             $out = json_encode($out);
+        }
 
         return $out;
     }
 
 }
diff --git a/lib/packages/menus/menu.class.php b/lib/packages/menus/menu.class.php
index 7b752cad8..7d6631257 100644
--- a/lib/packages/menus/menu.class.php
+++ b/lib/packages/menus/menu.class.php
@@ -40,11 +40,14 @@ class menu
 					 WHERE menu_id = '.$this->id.' ORDER BY position ASC');
 					 
 		$this->functions = $DB->result('function_id');
 		*/
 		$this->functions	= json_decode($main->functions);
-		if(empty($this->functions))	$this->functions = array();		
+		if(empty($this->functions))
+        {
+            $this->functions = array();
+        }
 	}
 	
 	public function load_from_post()
 	{
 		$this->codename		= $_REQUEST['codename'];
@@ -57,23 +60,26 @@ class menu
 		$functions = explode('#', $_REQUEST['menu-functions']);
 		$this->functions = array();
 		foreach($functions as $function)
 		{
 			if(!empty($function))
-				$this->functions[] = $function;
+            {
+                $this->functions[] = $function;
+            }
 		}
-	}	
-	
+	}
 	
 	public function save()
 	{
-		global $DB;
-
 		if(!empty($this->id))
-		  return $this->update();
+        {
+            return $this->update();
+        }
 		else
-		  return $this->insert();
+        {
+            return $this->insert();
+        }
 	}
 	
 	public function delete()
 	{
 		global $DB;
@@ -109,11 +115,13 @@ class menu
 				'enabled' => value_or_default($this->enabled, 0)
 			)
 		);
 				
 		if(!$ok)
-			throw new Exception($DB->get_last_error());
+        {
+            throw new Exception($DB->get_last_error());
+        }
 		
 		$this->id = $DB->get_last_id();
 		
 		return true;
 	}	
@@ -137,11 +145,13 @@ class menu
 				'enabled' => value_or_default($this->enabled, 0)
 			)
         );
 		
 		if(!$ok)
-			throw new Exception($DB->get_last_error());
+        {
+            throw new Exception($DB->get_last_error());
+        }
 		
 		return true;
 	}
 	
 	public function quicksearch($text)
@@ -177,11 +187,13 @@ class menu
 
         $DB->query('SELECT * FROM nv_menus', 'object');
         $out = $DB->result();
 
         if($type='json')
+        {
             $out = json_encode($out);
+        }
 
         return $out;
     }
 }
 
diff --git a/lib/packages/menus/menus.php b/lib/packages/menus/menus.php
index 4fb7be50d..d30be7bcd 100644
--- a/lib/packages/menus/menus.php
+++ b/lib/packages/menus/menus.php
@@ -56,16 +56,18 @@ function run()
                     {
                         return false;
                     }
                     $orderby = $_REQUEST['sidx'].' '.$_REQUEST['sord'];
 				
-					$DB->queryLimit('id,lid,codename,icon,enabled', 
-									'nv_menus', 
-									$where, 
-									$orderby, 
-									$offset, 
-									$max);
+					$DB->queryLimit(
+					    'id,lid,codename,icon,enabled',
+                        'nv_menus',
+                        $where,
+                        $orderby,
+                        $offset,
+                        $max
+                    );
 									
 					$dataset = $DB->result();
 					$total = $DB->foundRows();
 					
 					//echo $DB->get_last_error();
@@ -150,13 +152,17 @@ function functions_list()
 	$navibars = new navibars();
 	$navitable = new navitable("functions_list");
 	
 	$navibars->title(t(244, 'Menus'));
 
-	$navibars->add_actions(	array(	'<a href="?fid='.$_REQUEST['fid'].'&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>',
-									'<a href="?fid='.$_REQUEST['fid'].'&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
-									'search_form' ));
+	$navibars->add_actions(
+	    array(
+	        '<a href="?fid='.$_REQUEST['fid'].'&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>',
+			'<a href="?fid='.$_REQUEST['fid'].'&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
+			'search_form'
+        )
+    );
 	
 	if($_REQUEST['quicksearch']=='true')
     {
         $navitable->setInitialURL("?fid=".$_REQUEST['fid'].'&act=json&_search=true&quicksearch='.$_REQUEST['navigate-quicksearch']);
     }
@@ -187,13 +193,17 @@ function functions_form($item)
 	
 	$navibars = new navibars();
 	$naviforms = new naviforms();
 	
 	if(empty($item->id))
-		$navibars->title(t(244, 'Menus').' / '.t(38, 'Create'));	
+    {
+        $navibars->title(t(244, 'Menus').' / '.t(38, 'Create'));
+    }
 	else
-		$navibars->title(t(244, 'Menus').' / '.t(170, 'Edit').' ['.$item->id.']');		
+    {
+        $navibars->title(t(244, 'Menus').' / '.t(170, 'Edit').' ['.$item->id.']');
+    }
 
 	if(empty($item->id))
 	{
 		$navibars->add_actions(
 		    array(
@@ -219,13 +229,17 @@ function functions_form($item)
                 );
             }
         ');
 	}
 	
-	$navibars->add_actions(	array(	(!empty($item->id)? '<a href="?fid=menus&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
-									'<a href="?fid=menus&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
-									'search_form' ));
+	$navibars->add_actions(
+	    array(
+	        (!empty($item->id)? '<a href="?fid=menus&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
+			'<a href="?fid=menus&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
+			'search_form'
+        )
+    );
 
 	$navibars->form();
 
 	$navibars->add_tab(t(43, "Main"));
 	
@@ -288,56 +302,74 @@ function functions_form($item)
 	$sortable_unassigned = array();
 	
 	$sortable_assigned[] = '<ul id="sortable_assigned" class="connectedSortable">';
 	$sortable_unassigned[] = '<ul id="sortable_unassigned" class="connectedSortable">';	
 	
-	if(empty($item->functions)) $item->functions = array();
+	if(empty($item->functions))
+    {
+        $item->functions = array();
+    }
 	
 	// already included menus on the profile
 	foreach($item->functions as $f)
 	{
 		foreach($functions as $function)
 		{		
 			if($function->id == $f)
 			{
 				if($function->enabled=='1')
-					$sortable_assigned[] = '<li class="ui-state-highlight" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+                {
+                    $sortable_assigned[] = '<li class="ui-state-highlight" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+                }
 				else
-					$sortable_assigned[] = '<li class="ui-state-highlight ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+                {
+                    $sortable_assigned[] = '<li class="ui-state-highlight ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+                }
 			}			
 		}
 	}
 	
 	// the other menus not included on the profile
 	foreach($functions as $function)
 	{
 		if(!in_array($function->id, $item->functions))
 		{
 			if($function->enabled=='1')
-				$sortable_unassigned[] = '<li class="ui-state-default" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+            {
+                $sortable_unassigned[] = '<li class="ui-state-default" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+            }
 			else
-				$sortable_unassigned[] = '<li class="ui-state-default ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+            {
+                $sortable_unassigned[] = '<li class="ui-state-default ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
+            }
 		}
 	}
 	
 	$sortable_assigned[] = '</ul>';
 	$sortable_unassigned[] = '</ul>';
 
 	//$navibars->add_tab_content('<pre>'.print_r($item->menus, true).'</pre>'); // margin-top: 12px; margin-left: 5px; float: left;
 	// position: absolute; margin-left: 483px; margin-top: -9px; width: 291px; height: 20px;
 
-	$navibars->add_tab_content_row(array(	'<label>'.t(78, 'Category').'</label>',
-											$naviforms->selectfield('menus_functions_category_select', $func_cats, $func_cats, 'web', "navigate_menus_change_functions_category();", false)
-										)
-									);
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(78, 'Category').'</label>',
+			$naviforms->selectfield('menus_functions_category_select', $func_cats, $func_cats, 'web', "navigate_menus_change_functions_category();", false)
+        )
+    );
 	
-	$navibars->add_tab_content($naviforms->hidden("menu-functions", implode('#', $item->functions)));	
-	$navibars->add_tab_content_row(array(	'<label>'.t(240, 'Functions').'</label>',
-											implode("\n", $sortable_assigned),
-											implode("\n", $sortable_unassigned)
-										)
-									);
+	$navibars->add_tab_content(
+	    $naviforms->hidden("menu-functions", implode('#', $item->functions))
+    );
+
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(240, 'Functions').'</label>',
+			implode("\n", $sortable_assigned),
+			implode("\n", $sortable_unassigned)
+        )
+    );
 									
 	$layout->add_script('
 		$("#menus_functions_category_select").css({ "width": "300px", "margin-left": "303px" });
 		
 		$("#sortable_assigned").sortable({
diff --git a/lib/packages/structure/structure.class.php b/lib/packages/structure/structure.class.php
index 02964b9f8..86574b674 100644
--- a/lib/packages/structure/structure.class.php
+++ b/lib/packages/structure/structure.class.php
@@ -81,10 +81,12 @@ class structure
         }
     }
 	
 	public function load_from_post()
 	{
+	    global $purifier;
+
 		if(intval($_REQUEST['parent'])!=$this->id)	// protection against selecting this same category as parent of itself
         {
             $this->parent 		= intval($_REQUEST['parent']);
         }
 			
@@ -117,17 +119,17 @@ class structure
 			
 			foreach($fields as $field)
 			{
 				if(substr($key, 0, strlen($field.'-'))==$field.'-')
                 {
-                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $value;
+                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $purifier->purify($value);
                 }
 			}
 		
 			if(substr($key, 0, strlen('path-'))=='path-')
             {
-                $this->paths[substr($key, strlen('path-'))] = $value;
+                $this->paths[substr($key, strlen('path-'))] = $purifier->purify($value);
             }
 		}		
 	}
 
 	public function save()
diff --git a/lib/packages/websites/website.class.php b/lib/packages/websites/website.class.php
index 86472707f..a9f1df3e1 100644
--- a/lib/packages/websites/website.class.php
+++ b/lib/packages/websites/website.class.php
@@ -166,19 +166,20 @@ class website
 	}
 	
 	public function load_from_post()
 	{
         global $theme;
+        global $purifier;
 
 		$ws_theme = $theme;
 		if($this->theme != $theme->name)
 		{
 			$ws_theme = new theme();
 			$ws_theme->load($this->theme);
 		}
 
-		$this->name				= $_REQUEST['title'];
+		$this->name				= $purifier->purify($_REQUEST['title']);
 		
 		$this->protocol			= $_REQUEST['protocol'];
 		$this->subdomain		= $_REQUEST['subdomain'];
 		$this->domain			= $_REQUEST['domain'];				
 		$this->folder			= $_REQUEST['folder'];

Vulnerable code: 			if(empty($value)) continue;
					$this->dictionary[substr($key, strlen($field.'-'))][$field] = $value;
				$this->paths[substr($key, strlen('path-'))] = $value;
			$this->categories	= explode(',', $_REQUEST['categories']);				
		global $DB;

			return $this->update();
			return $this->insert();			
		    throw new Exception($DB->get_last_error());
			$cols[] = 'i.id IN ('.implode(',', $dict_ids).')';
			$id = $current['id'];
			if($limit <= 0)	$limit = 10;
							$fitem->description = '<img src="'.$image.'&width=640"><br />'.$fitem->description;
		if(empty($this->functions))	$this->functions = array();		
				$this->functions[] = $function;
	}	
	
		global $DB;

		  return $this->update();
		  return $this->insert();
			throw new Exception($DB->get_last_error());
			throw new Exception($DB->get_last_error());
					$DB->queryLimit('id,lid,codename,icon,enabled', 
									'nv_menus', 
									$where, 
									$orderby, 
									$offset, 
									$max);
	$navibars->add_actions(	array(	'<a href="?fid='.$_REQUEST['fid'].'&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>',
									'<a href="?fid='.$_REQUEST['fid'].'&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
									'search_form' ));
		$navibars->title(t(244, 'Menus').' / '.t(38, 'Create'));	
		$navibars->title(t(244, 'Menus').' / '.t(170, 'Edit').' ['.$item->id.']');		
	$navibars->add_actions(	array(	(!empty($item->id)? '<a href="?fid=menus&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
									'<a href="?fid=menus&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
									'search_form' ));
	if(empty($item->functions)) $item->functions = array();
					$sortable_assigned[] = '<li class="ui-state-highlight" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
					$sortable_assigned[] = '<li class="ui-state-highlight ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
				$sortable_unassigned[] = '<li class="ui-state-default" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
				$sortable_unassigned[] = '<li class="ui-state-default ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
	$navibars->add_tab_content_row(array(	'<label>'.t(78, 'Category').'</label>',
											$naviforms->selectfield('menus_functions_category_select', $func_cats, $func_cats, 'web', "navigate_menus_change_functions_category();", false)
										)
									);
	$navibars->add_tab_content($naviforms->hidden("menu-functions", implode('#', $item->functions)));	
	$navibars->add_tab_content_row(array(	'<label>'.t(240, 'Functions').'</label>',
											implode("\n", $sortable_assigned),
											implode("\n", $sortable_unassigned)
										)
									);
                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $value;
                $this->paths[substr($key, strlen('path-'))] = $value;
		$this->name				= $_REQUEST['title'];
Fixed code: 	    global $purifier;

			if(empty($value))
            {
                continue;
            }
                {
                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $purifier->purify($value);
                }
            {
                $this->paths[substr($key, strlen('path-'))] = $purifier->purify($value);
            }
        {
            $this->categories	= explode(',', $_REQUEST['categories']);
        }
        {
            return $this->update();
        }
        {
            return $this->insert();
        }
        {
        }
        {
            throw new Exception($DB->get_last_error());
        }
        {
            $cols[] = 'i.id IN ('.implode(',', $dict_ids).')';
        }
        {
            $id = $current['id'];
        }
        {
        }
			if($limit <= 0)
            {
                $limit = 10;
            }
                        {
                        }
                                {
                                }
                                {
                                }
                                {
                                }
                            {
                            }
                        {
                            $fitem->description = '<img src="'.$image.'&width=640"><br />'.$fitem->description;
                        }
        {
        }
		if(empty($this->functions))
        {
            $this->functions = array();
        }
            {
                $this->functions[] = $function;
            }
	}
        {
            return $this->update();
        }
        {
            return $this->insert();
        }
        {
            throw new Exception($DB->get_last_error());
        }
        {
            throw new Exception($DB->get_last_error());
        }
        {
        }
					$DB->queryLimit(
					    'id,lid,codename,icon,enabled',
                        'nv_menus',
                        $where,
                        $orderby,
                        $offset,
                        $max
                    );
	$navibars->add_actions(
	    array(
	        '<a href="?fid='.$_REQUEST['fid'].'&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>',
			'<a href="?fid='.$_REQUEST['fid'].'&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
			'search_form'
        )
    );
    {
        $navibars->title(t(244, 'Menus').' / '.t(38, 'Create'));
    }
    {
        $navibars->title(t(244, 'Menus').' / '.t(170, 'Edit').' ['.$item->id.']');
    }
	$navibars->add_actions(
	    array(
	        (!empty($item->id)? '<a href="?fid=menus&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
			'<a href="?fid=menus&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
			'search_form'
        )
    );
	if(empty($item->functions))
    {
        $item->functions = array();
    }
                {
                    $sortable_assigned[] = '<li class="ui-state-highlight" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
                }
                {
                    $sortable_assigned[] = '<li class="ui-state-highlight ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
                }
            {
                $sortable_unassigned[] = '<li class="ui-state-default" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
            }
            {
                $sortable_unassigned[] = '<li class="ui-state-default ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
            }
	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(78, 'Category').'</label>',
			$naviforms->selectfield('menus_functions_category_select', $func_cats, $func_cats, 'web', "navigate_menus_change_functions_category();", false)
        )
    );
	$navibars->add_tab_content(
	    $naviforms->hidden("menu-functions", implode('#', $item->functions))
    );

	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(240, 'Functions').'</label>',
			implode("\n", $sortable_assigned),
			implode("\n", $sortable_unassigned)
        )
    );
	    global $purifier;

                    $this->dictionary[substr($key, strlen($field.'-'))][$field] = $purifier->purify($value);
                $this->paths[substr($key, strlen('path-'))] = $purifier->purify($value);
        global $purifier;
		$this->name				= $purifier->purify($_REQUEST['title']);