CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/gallery/lib/tiles.php, apps/gallery/templates/index.php
Commit date: 2012-06-11 11:54:03 +0200
Commit message: Sanitizing user input

Diff: diff --git a/apps/gallery/lib/tiles.php b/apps/gallery/lib/tiles.php
index e43c99bb7..5837c752e 100644
--- a/apps/gallery/lib/tiles.php
+++ b/apps/gallery/lib/tiles.php
@@ -139,11 +139,11 @@ class TileStack extends TileBase {
 		}
 		return min(IMAGE_WIDTH, $max);
 	}
 
 	public function get() {
-		$r = '<div class="title gallery_div">'.$this->stack_name.'</div>';
+		$r = '<div class="title gallery_div">'.htmlentities($this->stack_name).'</div>';
 		for ($i = 0; $i < count($this->tiles_array); $i++) {
 			$top = rand(-5, 5);
 			$left = rand(-5, 5);
 			$img_w = $this->tiles_array[$i]->getWidth();
 			$extra = '';
@@ -166,11 +166,11 @@ class TileStack extends TileBase {
 	public function getCount() {
 		return count($this->tiles_array);
 	}
 	
 	public function getOnClickAction() {
-		return 'javascript:openNewGal(\''.$this->stack_name.'\');';
+		return 'javascript:openNewGal(\''.htmlentities($this->stack_name).'\');';
 	}
 
 	private $tiles_array;
 	private $stack_name;
 }
diff --git a/apps/gallery/templates/index.php b/apps/gallery/templates/index.php
index fd83490d6..f99260454 100644
--- a/apps/gallery/templates/index.php
+++ b/apps/gallery/templates/index.php
@@ -12,11 +12,11 @@ div.gallery_div img.shrinker {width:80px !important;}
 div.title { opacity: 0; text-align: center; vertical-align: middle; font-family: Arial; font-size: 12px; border: 0; position: absolute; text-overflow: ellipsis; bottom: 20px; left:5px; height:auto; padding: 5px; width: 140px; background-color: black; color: white; -webkit-transition: opacity 0.5s;  z-index:1000; border-radius: 7px}
 div.visible { opacity: 0.8;}
 </style>
 <script type="text/javascript">
 
-var root = "<?php echo $root; ?>";
+var root = "<?php echo htmlentities($root); ?>";
 
 function explode(element) {
 	$('div', element).each(function(index, elem) {
 	 	if ($(elem).hasClass('title')) {
 		 	$(elem).addClass('visible');

Vulnerable code: 		$r = '<div class="title gallery_div">'.$this->stack_name.'</div>';
		return 'javascript:openNewGal(\''.$this->stack_name.'\');';
var root = "<?php echo $root; ?>";
Fixed code: 		$r = '<div class="title gallery_div">'.htmlentities($this->stack_name).'</div>';
		return 'javascript:openNewGal(\''.htmlentities($this->stack_name).'\');';
var root = "<?php echo htmlentities($root); ?>";