CVE-2021-21319 (PHP, published 2021-10-25T16:15Z)
Description: value: Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/galette/galette
Files changed:
galette/lib/Galette/Controllers/AuthController.php
galette/lib/Galette/Controllers/Crud/MembersController.php
galette/lib/Galette/Controllers/DynamicTranslationsController.php
galette/lib/Galette/Controllers/GaletteController.php
galette/lib/Galette/Controllers/HistoryController.php
galette/lib/Galette/Controllers/PdfController.php
galette/lib/Galette/Controllers/PluginsController.php
galette/lib/Galette/Entity/Adherent.php
galette/templates/default/gestion_adherents.tpl
galette/templates/default/history.tpl
galette/templates/default/voir_adherent.tpl
Commit message: Prevent some possible XSS

Few fixes
Enhance type hinting


Vulnerable code:
            $login_adh = $post['login'];
                $filters->show = $post['nbshow'];
                $filters->show = $post['nbshow'];
                                    $fs_search = $post['free_text'][$i];
            $filters->show = $post['nbshow'];
            $params['the_id'] = $post['gid'];
            $params['excluded'] = $post['id_adh'];
                'label'     =>  $post[$field . '_label'],
                $filters->show = $post['nbshow'];
                $model = new $class($this->zdb, $this->preferences, (int)$_POST[PdfModel::PK]);
        } elseif (isset($_POST['previous_version'])) {
            $install->setInstalledVersion($_POST['previous_version']);
                        $_POST['previous_version']
        return $str;
                        return $address;
                        <a href="{path_for name="member" data=["id" => $member->id]}">{$member->sname}{if $member->company_name} ({$member->company_name}){/if}</a>
            {assign var=value value=$member->$propname}
            {if $column->field_id eq 'pseudo_adh'}
                {assign var=value value=$member->$propname|htmlspecialchars}
                <option value="{$action}"{if $history->filters->action_filter eq $action} selected="selected"{/if}>{$action}</option>
                    <td data-title="{_T string="Action"}">{$log.action_log}</td>
                        {$log.text_log}
                    title="{_T string="Create a new member with %name information." pattern="/%name/" replace=$member->sname}"
            {assign var="value" value=$member->sfullname|escape}

Fixed code:
            $login_adh = htmlspecialchars($post['login'], ENT_QUOTES);
                $filters->show = (int)$post['nbshow'];
                $filters->show = (int)$post['nbshow'];
                                    $fs_search = htmlspecialchars($post['free_text'][$i], ENT_QUOTES);
            $filters->show = (int)$post['nbshow'];
            $params['the_id'] = (int)$post['gid'];
            $params['excluded'] = (int)$post['id_adh'];
        $post['text_orig'] = htmlspecialchars($post['text_orig'], ENT_QUOTES);
                'label'     =>  htmlspecialchars($post[$field . '_label'], ENT_QUOTES),
                $filters->show = (int)$post['nbshow'];
                $model = new $class($this->zdb, $this->preferences, (int)$post[PdfModel::PK]);
        } elseif (isset($post['previous_version'])) {
            $install->setInstalledVersion($post['previous_version']);
                        $post['previous_version']
        return strip_tags($str);
                        return htmlspecialchars($address, ENT_QUOTES);
                        <a href="{path_for name="member" data=["id" => $member->id]}">{$member->sname}{if $member->company_name} ({$member->company_name|escape}){/if}</a>
            {assign var=value value=$member->$propname|escape}
            {if $column->field_id eq 'nom_adh'}
                {assign var="value" value=$member->sfullname}
            {elseif $column->field_id eq 'pseudo_adh'}
                {assign var=value value=$member->$propname|escape}
                <option value="{$action|escape}"{if $history->filters->action_filter eq $action} selected="selected"{/if}>{$action|escape}</option>
                    <td data-title="{_T string="Action"}">{$log.action_log|escape}</td>
                        {$log.text_log|escape}
                    title="{_T string="Create a new member with %name information." pattern="/%name/" replace=$member->sfullname}"
            {assign var="value" value=$member->sfullname}