CVE-2022-0602: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-05T16:15Z
Repository: https://github.com/tastyigniter/tastyigniter
Language: PHP
Files changed: app/admin/formwidgets/ScheduleEditor.php, app/admin/formwidgets/scheduleeditor/schedules.blade.php, app/main/formwidgets/components/component.blade.php, app/system/models/config/mail_templates_model.php
Commit date: 2022-03-10 22:11:52 +0000
Commit message: Minor fixes

Signed-off-by: Sam Poyigi <6567634+sampoyigi@users.noreply.github.com>

Diff: diff --git a/app/admin/formwidgets/ScheduleEditor.php b/app/admin/formwidgets/ScheduleEditor.php
index a608a2ac..828ee874 100644
--- a/app/admin/formwidgets/ScheduleEditor.php
+++ b/app/admin/formwidgets/ScheduleEditor.php
@@ -1,15 +1,17 @@
 <?php
 
 namespace Admin\FormWidgets;
 
 use Admin\Classes\BaseFormWidget;
+use Admin\Models\Locations_model;
 use Admin\Models\Working_hours_model;
 use Admin\Traits\ValidatesForm;
 use Admin\Widgets\Form;
 use Igniter\Flame\Exception\ApplicationException;
 use Igniter\Flame\Location\Models\AbstractLocation;
+use Igniter\Flame\Location\OrderTypes;
 use Illuminate\Support\Facades\DB;
 
 class ScheduleEditor extends BaseFormWidget
 {
     use ValidatesForm;
@@ -70,11 +72,11 @@ class ScheduleEditor extends BaseFormWidget
     public function onLoadRecord()
     {
         $scheduleCode = post('recordId');
         $scheduleItem = $this->getSchedule($scheduleCode);
 
-        $formTitle = sprintf(lang($this->formTitle), lang('admin::lang.text_'.$scheduleCode));
+        $formTitle = sprintf(lang($this->formTitle), lang($scheduleItem->name));
 
         return $this->makePartial('recordeditor/form', [
             'formRecordId' => $scheduleCode,
             'formTitle' => $formTitle,
             'formWidget' => $this->makeScheduleFormWidget($scheduleItem),
@@ -123,14 +125,19 @@ class ScheduleEditor extends BaseFormWidget
     protected function listSchedules()
     {
         if ($this->schedulesCache)
             return $this->schedulesCache;
 
-        $schedules = [];
-        foreach ($this->model->availableWorkingTypes() as $scheduleCode) {
-            $schedules[$scheduleCode] = $this->model->createScheduleItem($scheduleCode);
-        }
+        $schedules = collect(OrderTypes::instance()->listOrderTypes())
+            ->prepend(['name' => 'admin::lang.text_opening'], Locations_model::OPENING)
+            ->mapWithKeys(function ($definition, $code) {
+                $scheduleItem = $this->model->createScheduleItem($code);
+                $scheduleItem->name = array_get($definition, 'name');
+
+                return [$code => $scheduleItem];
+            })
+            ->all();
 
         return $this->schedulesCache = $schedules;
     }
 
     protected function makeScheduleFormWidget($scheduleItem)
diff --git a/app/admin/formwidgets/scheduleeditor/schedules.blade.php b/app/admin/formwidgets/scheduleeditor/schedules.blade.php
index ff42df25..b6572c5b 100644
--- a/app/admin/formwidgets/scheduleeditor/schedules.blade.php
+++ b/app/admin/formwidgets/scheduleeditor/schedules.blade.php
@@ -1,18 +1,18 @@
-<div class="row">
-    @foreach ($schedules as $schedule)
-        <div class="col-lg-4 py-3">
+<div class="d-flex flex-nowrap overflow-auto">
+    @foreach ($schedules as $scheduleCode => $schedule)
+        <div class="col-lg-3 {{ $loop->first ? 'py-2 pr-2 pl-0' : 'p-2' }}">
             <div
                 id="{{ $this->getId('item-'.$loop->iteration) }}"
                 class="card bg-light shadow-sm mb-0"
                 data-editor-control="load-schedule"
-                data-schedule-code="{{ $schedule->name }}"
+                data-schedule-code="{{ $scheduleCode }}"
                 role="button"
             >
                 <div class="card-body">
                     <div class="flex-fill">
-                        <h5 class="card-title">{{ lang('admin::lang.text_'.$schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
+                        <h5 class="card-title">{{ lang($schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
                         <p class="card-text">{{ lang('admin::lang.locations.text_'.$schedule->type) }}</p>
                     </div>
 
                     <div class="pt-3">
                         @foreach($schedule->getFormatted() as $value)
diff --git a/app/main/formwidgets/components/component.blade.php b/app/main/formwidgets/components/component.blade.php
index a742e229..d75149ac 100644
--- a/app/main/formwidgets/components/component.blade.php
+++ b/app/main/formwidgets/components/component.blade.php
@@ -1,11 +1,11 @@
 <div
     class="components-item"
     data-control="component"
     data-component-alias="{{ $component->alias }}"
 >
-    <div class="btn btn-light text-left p-3 component{{ $component->fatalError ? ' border-danger' : '' }}">
+    <div class="btn btn-light text-left p-3 w-100 component{{ $component->fatalError ? ' border-danger' : '' }}">
         <div
             class="components-item-info"
             data-component-control="load"
             data-component-context="edit"
         >
diff --git a/app/system/models/config/mail_templates_model.php b/app/system/models/config/mail_templates_model.php
index 0f3e1ec3..74bcd3f7 100644
--- a/app/system/models/config/mail_templates_model.php
+++ b/app/system/models/config/mail_templates_model.php
@@ -60,10 +60,11 @@ $config['list']['columns'] = [
     ],
     'created_at' => [
         'label' => 'lang:admin::lang.column_date_added',
         'type' => 'timetense',
         'searchable' => TRUE,
+        'invisible' => TRUE,
     ],
     'template_id' => [
         'label' => 'lang:admin::lang.column_id',
         'invisible' => TRUE,
     ],

Vulnerable code:         $formTitle = sprintf(lang($this->formTitle), lang('admin::lang.text_'.$scheduleCode));
        $schedules = [];
        foreach ($this->model->availableWorkingTypes() as $scheduleCode) {
            $schedules[$scheduleCode] = $this->model->createScheduleItem($scheduleCode);
        }
<div class="row">
    @foreach ($schedules as $schedule)
        <div class="col-lg-4 py-3">
                data-schedule-code="{{ $schedule->name }}"
                        <h5 class="card-title">{{ lang('admin::lang.text_'.$schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
    <div class="btn btn-light text-left p-3 component{{ $component->fatalError ? ' border-danger' : '' }}">
Fixed code: use Admin\Models\Locations_model;
use Igniter\Flame\Location\OrderTypes;
        $formTitle = sprintf(lang($this->formTitle), lang($scheduleItem->name));
        $schedules = collect(OrderTypes::instance()->listOrderTypes())
            ->prepend(['name' => 'admin::lang.text_opening'], Locations_model::OPENING)
            ->mapWithKeys(function ($definition, $code) {
                $scheduleItem = $this->model->createScheduleItem($code);
                $scheduleItem->name = array_get($definition, 'name');

                return [$code => $scheduleItem];
            })
            ->all();
<div class="d-flex flex-nowrap overflow-auto">
    @foreach ($schedules as $scheduleCode => $schedule)
        <div class="col-lg-3 {{ $loop->first ? 'py-2 pr-2 pl-0' : 'p-2' }}">
                data-schedule-code="{{ $scheduleCode }}"
                        <h5 class="card-title">{{ lang($schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
    <div class="btn btn-light text-left p-3 w-100 component{{ $component->fatalError ? ' border-danger' : '' }}">
        'invisible' => TRUE,