CVE-2022-2924 (Other, published 2022-09-20T06:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Files changed:
config/version.php
layouts/basic/modules/Vtiger/dashboards/Calendar.tpl
layouts/basic/modules/Vtiger/dashboards/CalendarActivitiesContents.tpl
layouts/basic/modules/Vtiger/dashboards/CalendarContents.tpl
layouts/basic/modules/Vtiger/dashboards/ChartFilter.tpl
layouts/basic/modules/Vtiger/dashboards/ChartFilterContents.tpl
layouts/basic/modules/Vtiger/dashboards/DashBoardContents.tpl
layouts/basic/modules/Vtiger/dashboards/DashBoardPreProcessAjax.tpl
layouts/basic/modules/Vtiger/dashboards/DashBoardWidgetsList.tpl
layouts/basic/modules/Vtiger/dashboards/DashboardHeaderIcons.tpl
layouts/basic/modules/Vtiger/dashboards/ListUpdatedRecordContents.tpl
layouts/basic/modules/Vtiger/dashboards/MailsList.tpl
layouts/basic/modules/Vtiger/dashboards/MiniListWizard.tpl
layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenew.tpl
layouts/basic/modules/Vtiger/dashboards/ProductsSoldToRenewContents.tpl
layouts/basic/modules/Vtiger/dashboards/SelectAccessibleTemplate.tpl
Commit message: Improved data display on some widgets


Vulnerable code:
	'appVersion' => '6.4.0',
	'patchVersion' => '2022.08.19',
							data-history="{implode(',',$HISTORY_STATUS)}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']}" {/if}>
			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()}" accesskey="">
								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()}&page={$PAGING_MODEL->getNextPage()}">
	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')}" />
	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')}" />
							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{$WIDGET_MODEL->getValueForEditView('title')}"></div>
					multiple="multiple" {else}name="filtersId[]" 
											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link}">{$VALUE}</a>
						data-url="{$WIDGET->getUrl()}"
						data-mode="open" data-name="{$WIDGET->getName()}" data-cache="{$WIDGET->get('cache')}"
					<li class="nav-item" data-module="{$MODULE_WIDGET}">
							<span class="yfm-{$MODULE_WIDGET} mx-1"></span>
			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{$WIDGET->getName()}" data-id="{$WIDGET->get('widgetid')}"
				data-widget-url="{$WIDGET->getUrl()}" data-linkid="{$WIDGET->get('linkid')}"
	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
						<td>{$item}</td>
				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()}&content=data" data-js="click">
					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()}" data-js="click">
								<option title="{$item['username']}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{$item['username']}</option>
											<input type="text" class="form-control" name="widgetTitle" value="{$WIDGET_MODEL->getValueForEditView('title')}"
													<option value="{$MODULE_MODEL['name']}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
					<option value="{$FIELD_NAME}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
						data-url="{$WIDGET_MODEL->getUrl()}"
			data-url="{$WIDGET_MODEL->getUrl()}"
				data-ajax-search="1" data-ajax-url="{$AJAX_URL}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()}"

Fixed code:
	'appVersion' => '6.4.1',
	'patchVersion' => '2022.08.22',
							data-history="{implode(',',$HISTORY_STATUS)|escape}" class="widgetFilterSwitch" {if !empty($WIDGET_DATA['defaultFilter'])} data-default-filter="{$WIDGET_DATA['defaultFilter']|escape}" {/if}>
			<div class="changeActivity u-cursor-pointer" data-url="{$ACTIVITY->getActivityStateModalUrl()|escape}" accesskey="">
								<br /><small class="small-a">{\App\Language::translate('LBL_FOR')}&nbsp;<strong>{$ACTIVITY->getDisplayValue('contractor')}</strong></small>, <strong><small class='small-a'><a href="{$CONTRACTOR->getDetailViewUrl()|escape}">{\App\TextUtils::textTruncate($CONTRACTOR->getDisplayName(), $HREFNAMELENGTH)}</a></small></strong>
				<button type="button" class="btn btn-sm btn-primary showMoreHistory" data-url="{$WIDGET->getUrl()|escape}&page={$PAGING_MODEL->getNextPage()}">
	<input type="hidden" id="activity_view" value="{$CURRENT_USER->getDetail('activity_view')|escape}" />
	<input type="hidden" id="date_format" value="{$CURRENT_USER->getDetail('date_format')|escape}" />
							<div class="{$COL_CTRL}"><input type="text" class="form-control" name="title" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"></div>
					multiple="multiple" {else}name="filtersId[]"
											<a href="{$CHART_DATA.$HEADER.$GROUP_HEADER.link|escape}">{$VALUE}</a>
						data-url="{$WIDGET->getUrl()|escape}"
						data-mode="open" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-cache="{$WIDGET->get('cache')|escape}"
					<li class="nav-item" data-module="{$MODULE_WIDGET|escape}">
							<span class="yfm-{$MODULE_WIDGET|escape} mx-1"></span>
			<a class="js-widget-list__item dropdown-item d-flex" href="#" data-name="{\App\Purifier::encodeHtml($WIDGET->getName())}" data-id="{$WIDGET->get('widgetid')}"
				data-widget-url="{$WIDGET->getUrl()|escape}" data-linkid="{$WIDGET->get('linkid')}"
	<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
		<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
						<td>{\App\Purifier::encodeHtml($item)}</td>
				<button class="btn btn-sm btn-light js-widget-refresh" title="{\App\Language::translate('LBL_REFRESH')}" data-url="{$WIDGET->getUrl()|escape}&content=data" data-js="click">
					<button class="btn btn-sm btn-light js-widget-remove" title="{\App\Language::translate('LBL_CLOSE')}" data-url="{$WIDGET->getDeleteUrl()|escape}" data-js="click">
								<option title="{\App\Purifier::encodeHtml($item['username'])}" value="{$item['user_id']}" {if $USER == $item['user_id']}selected{/if}>{\App\Purifier::encodeHtml($item['username'])}</option>
											<input type="text" class="form-control" name="widgetTitle" value="{\App\Purifier::encodeHtml($WIDGET_MODEL->getValueForEditView('title'))}"
													<option value="{$MODULE_MODEL['name']|escape}" {if $MODULE_MODEL['name'] === $VALUE_FIELD} selected{/if}>{App\Language::translate($MODULE_MODEL['name'], $MODULE_MODEL['name'])}</option>
					<option value="{$FIELD_NAME|escape}">{\App\Language::translate($FIELD->getFieldLabel(),$SELECTED_MODULE)}</option>
						data-url="{$WIDGET_MODEL->getUrl()|escape}"
			data-url="{$WIDGET_MODEL->getUrl()|escape}"
				data-ajax-search="1" data-ajax-url="{$AJAX_URL|escape}" data-minimum-input="{App\Config::performance('OWNER_MINIMUM_INPUT_LENGTH')}"
				<option value="{$USER_MODEL->getId()}" data-name="{$USER_MODEL->getName()|escape}"