CVE-2023-50256: Insufficient Information (NVD-CWE-noinfo)
value: Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2024-01-03T23:15Z
Repository: https://github.com/Froxlor/Froxlor
Language: PHP
Files changed: lib/Froxlor/Api/Commands/Customers.php, templates/Froxlor/assets/js/jquery/validation.js
Commit date: 2023-12-15 09:36:06 +0100
Commit message: Merge pull request from GHSA-625g-fm5w-w7w4

* fix possibility to have empty name/surname and empty company

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

* let js validation for customer add/edit form also trim() entered data to avoid empty values pass the client-side validation

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

---------

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
Diff: diff --git a/lib/Froxlor/Api/Commands/Customers.php b/lib/Froxlor/Api/Commands/Customers.php
index f9cd52a8a4..e6cb2c0f48 100644
--- a/lib/Froxlor/Api/Commands/Customers.php
+++ b/lib/Froxlor/Api/Commands/Customers.php
@@ -1051,11 +1051,11 @@ class Customers extends ApiCommand implements ResourceEntity
 
 			$idna_convert = new IdnaWrapper();
 			$email = $this->getParam('email', true, $idna_convert->decode($result['email']));
 			$name = $this->getParam('name', true, $result['name']);
 			$firstname = $this->getParam('firstname', true, $result['firstname']);
-			$company_required = empty($result['company']) && ((!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname)));
+			$company_required = (!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname));
 			$company = $this->getParam('company', !$company_required, $result['company']);
 			$street = $this->getParam('street', true, $result['street']);
 			$zipcode = $this->getParam('zipcode', true, $result['zipcode']);
 			$city = $this->getParam('city', true, $result['city']);
 			$phone = $this->getParam('phone', true, $result['phone']);
diff --git a/templates/Froxlor/assets/js/jquery/validation.js b/templates/Froxlor/assets/js/jquery/validation.js
index f4692e055b..b3ccc6a9fb 100644
--- a/templates/Froxlor/assets/js/jquery/validation.js
+++ b/templates/Froxlor/assets/js/jquery/validation.js
@@ -6,22 +6,22 @@ export default function () {
 		$('#customer_add,#customer_edit').each(function () {
 			$(this).validate({
 				rules: {
 					'name': {
 						required: function () {
-							return $('#company').val().length === 0 || $('#firstname').val().length > 0;
+							return $('#company').val().trim().length === 0 || $('#firstname').val().trim().length > 0;
 						}
 					},
 					'firstname': {
 						required: function () {
-							return $('#company').val().length === 0 || $('#name').val().length > 0;
+							return $('#company').val().trim().length === 0 || $('#name').val().trim().length > 0;
 						}
 					},
 					'company': {
 						required: function () {
-							return $('#name').val().length === 0
-								&& $('#firstname').val().length === 0;
+							return $('#name').val().trim().length === 0
+								&& $('#firstname').val().trim().length === 0;
 						}
 					}
 				},
 			});
 		});

Vulnerable code: 			$company_required = empty($result['company']) && ((!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname)));
							return $('#company').val().length === 0 || $('#firstname').val().length > 0;
							return $('#company').val().length === 0 || $('#name').val().length > 0;
							return $('#name').val().length === 0
								&& $('#firstname').val().length === 0;
Fixed code: 			$company_required = (!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname));
							return $('#company').val().trim().length === 0 || $('#firstname').val().trim().length > 0;
							return $('#company').val().trim().length === 0 || $('#name').val().trim().length > 0;
							return $('#name').val().trim().length === 0
								&& $('#firstname').val().trim().length === 0;