Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function setup($parentFieldArray, $vardef, $displayParams, $tabindex, $twopass = true)
    {
        parent::setup($parentFieldArray, $vardef, $displayParams, $tabindex, $twopass);
        $editor = "";

        if (isset($vardef['editor']) && $vardef['editor'] == "html") {
            if (!isset($displayParams['htmlescape'])) {
                $displayParams['htmlescape'] = false;
            }

            if ($_REQUEST['action'] == "EditView") {
                require_once(__DIR__ . "/../../../../include/SugarTinyMCE.php");
                $tiny = new SugarTinyMCE();
                $editor = $tiny->getInstance($vardef['name'], 'email_compose_light');
            }
        }

        $this->ss->assign("tinymce", $editor);
    }