CVE-2022-3000: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-20T07:15Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: Other
Files changed: config/version.php, layouts/basic/modules/Settings/LayoutEditor/EditField.tpl
Commit date: 2022-08-26 08:05:27 +0200
Commit message: Improved display of data in the modal field editing window

Diff: diff --git a/config/version.php b/config/version.php
index efe5e789295d..a11f7ab97134 100644
--- a/config/version.php
+++ b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.4.11',
-	'patchVersion' => '2022.08.25',
+	'appVersion' => '6.4.12',
+	'patchVersion' => '2022.08.26',
 	'lib_roundcube' => '0.3.1',
 ];
diff --git a/layouts/basic/modules/Settings/LayoutEditor/EditField.tpl b/layouts/basic/modules/Settings/LayoutEditor/EditField.tpl
index 3477ddbc1229..ac16f42d1cb4 100644
--- a/layouts/basic/modules/Settings/LayoutEditor/EditField.tpl
+++ b/layouts/basic/modules/Settings/LayoutEditor/EditField.tpl
@@ -20,27 +20,27 @@
 				<input type="hidden" name="module" value="LayoutEditor" />
 				<input type="hidden" name="parent" value="Settings" />
 				<input type="hidden" name="action" value="Field" />
 				<input type="hidden" name="mode" value="save" />
 				<input type="hidden" name="fieldid" value="{$FIELD_MODEL->getId()}" />
-				<input type="hidden" name="sourceModule" value="{$SELECTED_MODULE_NAME}" />
+				<input type="hidden" name="sourceModule" value="{$SELECTED_MODULE_NAME|escape}" />
 				<div class="row mx-0 mb-2 py-2 border-bottom">
 					<div class="col-md-6">
 						<strong>{App\Language::translate('LBL_LABEL_NAME', $QUALIFIED_MODULE)}: </strong>{$FIELD_LABEL_TRANSLATION}<br />
 						<strong>{App\Language::translate('LBL_FIELD_NAME', $QUALIFIED_MODULE)}: </strong>{$FIELD_MODEL->getFieldName()}
 					</div>
 					<div class="col-md-6">
 						<strong>{App\Language::translate('LBL_FIELD_TYPE', $QUALIFIED_MODULE)}: </strong> {if isset($FIEL_TYPE_LABEL[$FIELD_MODEL->getUIType()])}{App\Language::translate($FIEL_TYPE_LABEL[$FIELD_MODEL->getUIType()], $QUALIFIED_MODULE)}{/if} (UiType: {$FIELD_MODEL->getUIType()})<br />
-						<strong>{App\Language::translate('LBL_LENGTH', $QUALIFIED_MODULE)}: </strong>{$FIELD_MODEL->get('maximumlength')}
+						<strong>{App\Language::translate('LBL_LENGTH', $QUALIFIED_MODULE)}: </strong>{$FIELD_MODEL->get('maximumlength')|escape}
 					</div>
 				</div>
 				<div class="row m-0">
 					<div class="col-md-6 px-1">
 						<div class="form-group">
 							<label for="fieldMask"><strong>{App\Language::translate('LBL_LABEL', $QUALIFIED_MODULE)}</strong></label>
 							<div class="input-group">
-								<input type="text" name="label" value="{$FIELD_MODEL->getFieldLabel()}" class="form-control"
+								<input type="text" name="label" value="{\App\Purifier::encodeHtml($FIELD_MODEL->getFieldLabel())}" class="form-control"
 									id="label" data-validation-engine="validate[maxSize[50]]" />
 							</div>
 						</div>
 						<div class="checkbox my-1">
 							<input type="hidden" name="mandatory" value="O" />
@@ -53,11 +53,11 @@
 						</div>
 						<div class="checkbox my-1">
 							<input type="hidden" name="presence" value="1" />
 							<input type="checkbox" name="presence" id="presence" {if $FIELD_MODEL->isActiveField()} checked {/if} {strip} {/strip}
 								{if $FIELD_MODEL->isActiveOptionDisabled()} readonly="readonly" class="optionDisabled" {/if} {if $IS_MANDATORY} readonly="readonly" {/if}
-								value="{$FIELD_MODEL->get('presence')}" />
+								value="{$FIELD_MODEL->get('presence')|escape}" />
 							<label for="presence">
 								{App\Language::translate('LBL_ACTIVE', $QUALIFIED_MODULE)}
 							</label>
 						</div>
 						<div class="checkbox my-1">
@@ -88,35 +88,35 @@
 								{assign var=HEADER_FIELD_VALUE value=$FIELD_MODEL->getHeaderValue('class')}
 								{assign var=HEADER_FIELD_TYPE value=$FIELD_MODEL->getHeaderValue('type', 'value')}
 								{assign var=HEADER_REL_FIELDS value=$FIELD_MODEL->getHeaderValue('rel_fields', [])}
 								<select name="header_type" class="js-header_type form-control select2">
 									{foreach key=LABEL item=VALUE from=$FIELD_MODEL->getUITypeModel()->getHeaderTypes()}
-										<option value="{$VALUE}" {if $VALUE == $HEADER_FIELD_TYPE} selected {/if}>{App\Language::translate($LABEL, $QUALIFIED_MODULE)}</option>
+										<option value="{\App\Purifier::encodeHtml($VALUE)}" {if $VALUE == $HEADER_FIELD_TYPE} selected {/if}>{App\Language::translate($LABEL, $QUALIFIED_MODULE)}</option>
 									{/foreach}
 								</select>
 								{if $FIELD_MODEL->isReferenceField() && count($FIELD_MODEL->getReferenceList()) eq 1}
 									<div class="js-header_rel_fields mt-1{if $HEADER_FIELD_TYPE neq 'value'} d-none{/if}">
 										<select name="header_rel_fields" multiple="multiple" class="form-control select2" data-select-cb="registerSelectSortable" data-maximum-selection-length="3">
 											{foreach item=REL_MODULE from=$FIELD_MODEL->getReferenceList()}
 												{assign var=REL_MODULE_MODEL value=\Vtiger_Module_Model::getInstance($REL_MODULE)}
 												{foreach from=$REL_MODULE_MODEL->getFields() key=REL_FIELD_NAME item=REL_FIELD_MODEL}
 													{if $REL_FIELD_MODEL->isViewableInDetailView()}
 														{assign var=ELEMENT_POSITION_IN_ARRAY value=array_search($REL_FIELD_NAME, $HEADER_REL_FIELDS)}
-														<option value="{$REL_FIELD_MODEL->getName()}" data-field-name="{$REL_FIELD_NAME}"
+														<option value="{$REL_FIELD_MODEL->getName()}" data-field-name="{$REL_FIELD_NAME|escape}"
 															{if $ELEMENT_POSITION_IN_ARRAY !== false}
-																data-sort-index="{$ELEMENT_POSITION_IN_ARRAY}" selected="selected"
+																data-sort-index="{$ELEMENT_POSITION_IN_ARRAY|escape}" selected="selected"
 															{/if}
 															data-js="data-sort-index|data-field-name">
 															{App\Language::translate($REL_FIELD_MODEL->getFieldLabel(), $REL_FIELD_MODEL->getModuleName())}
 														</option>
 													{/if}
 												{/foreach}
 											{/foreach}
 										</select>
 									</div>
 								{/if}
-								<input name="header_class" value="{if $HEADER_FIELD_VALUE}{$HEADER_FIELD_VALUE}{else}badge-info{/if}" type="text" class="hide">
+								<input name="header_class" value="{if $HEADER_FIELD_VALUE}{$HEADER_FIELD_VALUE|escape}{else}badge-info{/if}" type="text" class="hide">
 							</div>
 						</div>
 						<div class="checkbox">
 							<input type="hidden" name="masseditable" value="2" />
 							<input type="checkbox" name="masseditable" id="masseditable" {if $FIELD_MODEL->isMassEditable()} checked {/if} {strip} {/strip}
@@ -158,11 +158,11 @@
 							<div class="form-group">
 								<label for="fieldMask"><strong>{App\Language::translate('LBL_FIELD_MASK', $QUALIFIED_MODULE)}</strong></label>
 								<div class=" input-group">
 									<input type="text" class="form-control" id="fieldMask" name="fieldMask"
 										{if $MAX_VALUE} data-validation-engine="validate[maxSize[{$MAX_VALUE}]]{/if}"
-										value="{if isset($PARAMS['mask'])}{$PARAMS['mask']}{/if}" />
+										value="{if isset($PARAMS['mask'])}{\App\Purifier::encodeHtml($PARAMS['mask'])}{/if}" />
 									<div class="input-group-append">
 										<span class="input-group-text js-popover-tooltip u-cursor-pointer" data-js="popover"
 											data-placement="top"
 											data-content="{App\Language::translate('LBL_FIELD_MASK_INFO', $QUALIFIED_MODULE)}">
 											<span class="fas fa-info-circle"></span>
@@ -172,11 +172,11 @@
 							</div>
 						{/if}
 						<div class="form-group">
 							<label for="maxlengthtext"><strong>{App\Language::translate('LBL_MAX_LENGTH_TEXT', $QUALIFIED_MODULE)}</strong></label>
 							<input type="text" class="form-control" id="maxlengthtext" name="maxlengthtext"
-								value="{$FIELD_MODEL->get('maxlengthtext')}" />
+								value="{$FIELD_MODEL->get('maxlengthtext')|escape}" />
 						</div>
 						<div class="form-group">
 							<label for="maxwidthcolumn"><strong>{App\Language::translate('LBL_MAX_WIDTH_COLUMN', $QUALIFIED_MODULE)}</strong></label>
 							<div class=" input-group">
 								<input type="text" class="form-control" id="maxwidthcolumn" name="maxwidthcolumn"

Vulnerable code: 	'appVersion' => '6.4.11',
	'patchVersion' => '2022.08.25',
				<input type="hidden" name="sourceModule" value="{$SELECTED_MODULE_NAME}" />
						<strong>{App\Language::translate('LBL_LENGTH', $QUALIFIED_MODULE)}: </strong>{$FIELD_MODEL->get('maximumlength')}
								<input type="text" name="label" value="{$FIELD_MODEL->getFieldLabel()}" class="form-control"
								value="{$FIELD_MODEL->get('presence')}" />
										<option value="{$VALUE}" {if $VALUE == $HEADER_FIELD_TYPE} selected {/if}>{App\Language::translate($LABEL, $QUALIFIED_MODULE)}</option>
														<option value="{$REL_FIELD_MODEL->getName()}" data-field-name="{$REL_FIELD_NAME}"
																data-sort-index="{$ELEMENT_POSITION_IN_ARRAY}" selected="selected"
								<input name="header_class" value="{if $HEADER_FIELD_VALUE}{$HEADER_FIELD_VALUE}{else}badge-info{/if}" type="text" class="hide">
										value="{if isset($PARAMS['mask'])}{$PARAMS['mask']}{/if}" />
								value="{$FIELD_MODEL->get('maxlengthtext')}" />
Fixed code: 	'appVersion' => '6.4.12',
	'patchVersion' => '2022.08.26',
				<input type="hidden" name="sourceModule" value="{$SELECTED_MODULE_NAME|escape}" />
						<strong>{App\Language::translate('LBL_LENGTH', $QUALIFIED_MODULE)}: </strong>{$FIELD_MODEL->get('maximumlength')|escape}
								<input type="text" name="label" value="{\App\Purifier::encodeHtml($FIELD_MODEL->getFieldLabel())}" class="form-control"
								value="{$FIELD_MODEL->get('presence')|escape}" />
										<option value="{\App\Purifier::encodeHtml($VALUE)}" {if $VALUE == $HEADER_FIELD_TYPE} selected {/if}>{App\Language::translate($LABEL, $QUALIFIED_MODULE)}</option>
														<option value="{$REL_FIELD_MODEL->getName()}" data-field-name="{$REL_FIELD_NAME|escape}"
																data-sort-index="{$ELEMENT_POSITION_IN_ARRAY|escape}" selected="selected"
								<input name="header_class" value="{if $HEADER_FIELD_VALUE}{$HEADER_FIELD_VALUE|escape}{else}badge-info{/if}" type="text" class="hide">
										value="{if isset($PARAMS['mask'])}{\App\Purifier::encodeHtml($PARAMS['mask'])}{/if}" />
								value="{$FIELD_MODEL->get('maxlengthtext')|escape}" />