CVE-2022-4637: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is ef49e709c8adecc3a83cdc6164a67162991d2213. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T22:15Z
Repository: https://github.com/tkrebs/ep3-bs
Language: PHP
Files changed: module/Backend/src/Backend/View/Helper/User/UserFormat.php, module/Backend/view/backend/booking/edit-choice.phtml, module/Backend/view/backend/booking/players.phtml, module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php, module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php, module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php, module/Frontend/view/frontend/index/userpanel.online.phtml
Commit date: 2022-10-07 02:49:47 +0200
Commit message: Fix potential XSS vulnerability, fixes #564

Diff: diff --git a/module/Backend/src/Backend/View/Helper/User/UserFormat.php b/module/Backend/src/Backend/View/Helper/User/UserFormat.php
index c029591..3a7a500 100644
--- a/module/Backend/src/Backend/View/Helper/User/UserFormat.php
+++ b/module/Backend/src/Backend/View/Helper/User/UserFormat.php
@@ -26,11 +26,11 @@ class UserFormat extends AbstractHelper
 
         $html .= sprintf('<td>%s</td>',
             $user->need('uid'));
 
         $html .= sprintf('<td>%s</td>',
-            $user->need('alias'));
+            $view->escapeHtml($user->need('alias')));
 
         $html .= sprintf('<td>%s</td>',
             $view->t($user->getStatus()));
 
         /* Email col */
@@ -74,6 +74,6 @@ class UserFormat extends AbstractHelper
         $html .= '</tr>';
 
         return $html;
     }
 
-}
\ No newline at end of file
+}
diff --git a/module/Backend/view/backend/booking/edit-choice.phtml b/module/Backend/view/backend/booking/edit-choice.phtml
index d906f6b..1411711 100644
--- a/module/Backend/view/backend/booking/edit-choice.phtml
+++ b/module/Backend/view/backend/booking/edit-choice.phtml
@@ -17,13 +17,13 @@ $this->setup(array(
             <p>
                 <a href="<?= $this->url('backend/booking/edit', [], ['query' => array_merge($this->query, ['r' => $rid])]) ?>" class="default-button squarebox-internal-link">
                     <span class="symbolic symbolic-booking">
                         <b><?= $this->timeRange($reservation->get('time_start'), $reservation->get('time_end'), '%s to %s') ?></b>
 
-                        <?= $this->t('from') ?> <?= $reservation->getExtra('booking')->getExtra('user')->get('alias') ?>
+                        <?= $this->t('from') ?> <?= $this->escapeHtml($reservation->getExtra('booking')->getExtra('user')->get('alias')) ?>
                     </span>
                 </a>
             </p>
 
         <?php endforeach; ?>
     </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/module/Backend/view/backend/booking/players.phtml b/module/Backend/view/backend/booking/players.phtml
index b545c68..24b51a3 100644
--- a/module/Backend/view/backend/booking/players.phtml
+++ b/module/Backend/view/backend/booking/players.phtml
@@ -16,11 +16,11 @@ $this->setup(array(
     <?php
 
     printf('<p>%s <a href="%s">%s</a></p>',
         $this->translate('Booked by'),
         $this->url('backend/user/edit', ['uid' => $this->user->need('uid')]),
-        $this->user->need('alias'));
+        $this->escapeHtml($this->user->need('alias')));
 
     echo '<div class="separator separator-line"></div>';
 
     echo '<table class="default-table middle-table" style="margin-left: 0;">';
 
@@ -61,11 +61,11 @@ $this->setup(array(
 
             printf('<td><span class="gray">%s %s:</span> <a href="%s">%s</a></td>',
                 $this->translate('User matched by'),
                 $this->translate(ucfirst($userMatch)),
                 $this->url('backend/user/edit', ['uid' => $user->need('uid')]),
-                $user->need('alias'));
+                $this->escapeHtml($user->need('alias')));
         } else {
             echo '<td></td>';
         }
 
         echo '</tr>';
diff --git a/module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php b/module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php
index bc2bffb..520e9fe 100644
--- a/module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php
+++ b/module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php
@@ -23,11 +23,11 @@ class FreeForPrivileged extends AbstractHelper
             $booking = $reservation->needExtra('booking');
 
             $cellLabel = $booking->needExtra('user')->need('alias');
             $cellGroup = ' cc-group-' . $booking->need('bid');
 
-            return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
+            return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
         } else {
 	        $labelFree = $square->getMeta('label.free', 'Still free');
 
             return $view->calendarCellLink($labelFree, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially');
         }
diff --git a/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php b/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php
index e852568..68a2bde 100644
--- a/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php
+++ b/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php
@@ -37,11 +37,11 @@ class OccupiedForPrivileged extends AbstractHelper
             $cellLabel = $booking->needExtra('user')->need('alias');
             $cellGroup = ' cc-group-' . $booking->need('bid');
 
             switch ($booking->need('status')) {
                 case 'single':
-                    return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
+                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
                 case 'subscription':
                     return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-multiple' . $cellGroup, null, $cellStyle);
             }
         }
     }
diff --git a/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php b/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php
index 5cdb98f..fde4929 100644
--- a/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php
+++ b/module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php
@@ -34,17 +34,17 @@ class OccupiedForVisitors extends AbstractHelper
                 case 'single':
                     if (! $cellLabel) {
                         $cellLabel = $this->view->t('Occupied');
                     }
 
-                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
+                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
                 case 'subscription':
                     if (! $cellLabel) {
                         $cellLabel = $this->view->t('Subscription');
                     }
 
-                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
+                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
             }
         }
     }
 
 }
diff --git a/module/Frontend/view/frontend/index/userpanel.online.phtml b/module/Frontend/view/frontend/index/userpanel.online.phtml
index 95ef88c..51d3c7d 100644
--- a/module/Frontend/view/frontend/index/userpanel.online.phtml
+++ b/module/Frontend/view/frontend/index/userpanel.online.phtml
@@ -1,10 +1,10 @@
 <table style="height: 100%;">
     <tr>
         <td class="responsive-pass-4" style="padding-right: 12px; border-right: solid 1px #CCC;">
             <div id="userpanel-status" class="no-wrap">
-                <?= sprintf($this->t('Online as %s'), $this->user->need('alias')) ?>
+                <?= sprintf($this->t('Online as %s'), $this->escapeHtml($this->user->need('alias'))) ?>
             </div>
         </td>
 
         <td class="responsive-pass-4" style="padding-right: 12px;"></td>
 
@@ -34,6 +34,6 @@
 
         <td style="padding-left: 12px; border-left: solid 1px #CCC;">
             <a href="<?= $this->url('service/help') ?>" class="default-button" data-tooltip="<?= sprintf($this->t('Get additional %shelp and information%s'), '<b>', '</b>') ?>"><b>?</b></a>
         </td>
     </tr>
-</table>
\ No newline at end of file
+</table>

Vulnerable code:             $user->need('alias'));
}
                        <?= $this->t('from') ?> <?= $reservation->getExtra('booking')->getExtra('user')->get('alias') ?>
</div>
        $this->user->need('alias'));
                $user->need('alias'));
            return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
                    return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
                <?= sprintf($this->t('Online as %s'), $this->user->need('alias')) ?>
</table>
Fixed code:             $view->escapeHtml($user->need('alias')));
}
                        <?= $this->t('from') ?> <?= $this->escapeHtml($reservation->getExtra('booking')->getExtra('user')->get('alias')) ?>
</div>
        $this->escapeHtml($this->user->need('alias')));
                $this->escapeHtml($user->need('alias')));
            return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
                <?= sprintf($this->t('Online as %s'), $this->escapeHtml($this->user->need('alias'))) ?>
</table>