CVE-2014-3840 (HTML, published 2014-05-27T13:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mayan-edms/mayan-edms
Files changed:
apps/common/templates/calculate_form_title.html
apps/common/templates/generic_detail.html
apps/common/templates/generic_form.html
apps/common/templates/generic_list.html
apps/common/templates/generic_list_horizontal.html
apps/common/templates/generic_list_subtemplate.html
Commit message: Remove the striptags functionality, fixes some instances of XSS, issue #3


Vulnerable code:
    {% if striptags %}
        {{ title|capfirst|striptags }}
    {% else %}
        {{ title|capfirst|safe }}
    {% endif %}
                {% blocktrans %}Edit {{ object_name }}:{% endblocktrans %} {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
                {% trans "Edit" %}: {% if not striptags %}<a href="{{ object.get_absolute_url }}">{% endif %}{{ object|capfirst }}{% if not striptags %}</a>{% endif %}
        {% endif %}                
{% block title %} :: {% with "true" as read_only %}{% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endwith %}{% endblock %}
        </div>        
  
                    <div class=""></div> 
    {% endfor %}     
        #subform form  textarea, 
        #subform form  input, 
        #subform form  select, 
                <div class=""></div> 
    
            <div class="grid_{{ subtemplate.grid|default:12 }}">       
                <div class="clear"></div> 
    </div>    
    
{% block title %} :: {% with "true" as striptags %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
                             
        <div class="grid_{{ subtemplate.grid|default:12 }}">       
            <div class="clear"></div> 
{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
{% block title %} :: {% blocktrans with title|striptags as stripped_title %}List of {{ stripped_title }}{% endblocktrans %}{% endblock %}
{% else %}    
    {% autopaginate object_list %} 
                {% endif %}          
            {% endif %}          
        
                            {% endfor %}            
                            {% endfor %}        
                        {% if multi_select or multi_select_as_buttons %}    
                        {% endfor %}                        
                        <tr><td colspan=99 class="tc">{% blocktrans with title|striptags as stripped_title %}There are no {{ stripped_title }}{% endblocktrans %}</td></tr>
            
                </div>            
            {% endif %}            
            
                {% endif %}  
            {% endif %}  
        
        {% endif %} 

Fixed code:
    {{ title|capfirst }}
                {% blocktrans with object as object and object_name as object_name %}Edit {{ object_name }}: {{ object }}{% endblocktrans %}
                {% blocktrans with object as object %}Edit: {{ object }}{% endblocktrans %}
        {% endif %}
{% block title %} :: {% with "true" as read_only %}{% include "calculate_form_title.html" %}{% endwith %}{% endblock %}
        </div>

                    <div class=""></div>
    {% endfor %}
        #subform form  textarea,
        #subform form  input,
        #subform form  select,
                <div class=""></div>

            <div class="grid_{{ subtemplate.grid|default:12 }}">
                <div class="clear"></div>
    </div>

{% block title %} :: {% include "calculate_form_title.html" %}{% endblock %}

        <div class="grid_{{ subtemplate.grid|default:12 }}">
            <div class="clear"></div>
{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
{% block title %} :: {% blocktrans with title as title %}List of {{ title }}{% endblocktrans %}{% endblock %}
{% else %}
    {% autopaginate object_list %}
                {% endif %}
            {% endif %}

                            {% endfor %}
                            {% endfor %}
                        {% if multi_select or multi_select_as_buttons %}
                        {% endfor %}
                        <tr><td colspan=99 class="tc">{% blocktrans with title as title %}There are no {{ title }}{% endblocktrans %}</td></tr>

                </div>
            {% endif %}

                {% endif %}
            {% endif %}

        {% endif %}