Program: CWE-352
Project: CVE-2021-3729
Buggy source:
{% extends './v1/layout/default' %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName) }}
{% endblock %}

{% block content %}
    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'currencies'|_ }}</h3>
                        <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                </div>
                <div class="box-body">
                    <p class="text-info">
                        {{ 'currencies_intro'|_ }}
                    </p>
                    <p class="text-info">
                        {{ 'currencies_default_disabled'|_ }}
                    </p>
                    {% if currencies|length > 0 %}
                        <div style="padding-left:8px;">
                            {{ currencies.links('v1.pagination.bootstrap-4')|raw }}
                        </div>
                        <table class="table table-hover">
                            <thead>
                            <tr>
                                {% if isOwner %}
                                    <th>&nbsp;</th>
                                {% endif %}
                                <th>{{ 'currency'|_ }}</th>
                                <th>{{ 'number_of_decimals'|_ }}</th>
                                <th>&nbsp;</th>
                            </tr>
                            </thead>
                            <tbody>
                            {% for currency in currencies %}
                                <tr>
                                    {% if isOwner %}
                                        <td>
                                            <div class="btn-group btn-group-xs">
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span class="fa fa-fw fa-trash"></span></a>
                                            </div>
                                        </td>
                                    {% endif %}
                                    <td>
                                        {% if currency.enabled == false %}
                                            <span class="text-muted">
                                        {% endif %}
                                        {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                        {% if currency.id == defaultCurrency.id %}
                                        <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                        {% endif %}
                                        {% if currency.enabled == false %}
                                        </span>
                                        <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                        {% endif %}
                                    </td>

                                    <td>{{ currency.decimal_places }}</td>
                                    <td class="buttons">
                                        <div class="btn-group">
                                        {% if currency.id != defaultCurrency.id %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.default',currency.id) }}">
                                                <span class="fa fa-fw fa-star"></span>
                                                {{ 'make_default_currency'|_ }}</a>
                                        {% endif %}
                                        {% if currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.disable',currency.id) }}">
                                                <span class="fa fa-fw fa-square-o"></span>
                                                {{ 'disable_currency'|_ }}</a>
                                        {% endif %}
                                        {% if not currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.enable',currency.id) }}">
                                                <span class="fa fa-fw fa-check-square-o"></span>
                                                {{ 'enable_currency'|_ }}</a>
                                        {% endif %}
                                        </div>
                                    </td>
                                </tr>
                            {% endfor %}
                            </tbody>
                        </table>
                        <div style="padding-left:8px;">
                            {{ currencies.links('v1.pagination.bootstrap-4')|raw }}
                        </div>
                    {% endif %}
                </div>
                <div class="box-footer">
                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                </div>
            </div>
        </div>
    </div>
{% endblock %}


Fixed version (ground truth):
{% extends './v1/layout/default' %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName) }}
{% endblock %}

{% block content %}
    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'currencies'|_ }}</h3>
                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                </div>
                <div class="box-body">
                    <p class="text-info">
                        {{ 'currencies_intro'|_ }}
                    </p>
                    <p class="text-info">
                        {{ 'currencies_default_disabled'|_ }}
                    </p>
                    {% if currencies|length > 0 %}
                        <div style="padding-left:8px;">
                            {{ currencies.links('v1.pagination.bootstrap-4')|raw }}
                        </div>
                        <table class="table table-hover">
                            <thead>
                            <tr>
                                {% if isOwner %}
                                    <th>&nbsp;</th>
                                {% endif %}
                                <th>{{ 'currency'|_ }}</th>
                                <th>{{ 'number_of_decimals'|_ }}</th>
                                <th>&nbsp;</th>
                            </tr>
                            </thead>
                            <tbody>
                            {% for currency in currencies %}
                                <tr>
                                    {% if isOwner %}
                                        <td>
                                            <div class="btn-group btn-group-xs">
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span
                                                            class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span
                                                            class="fa fa-fw fa-trash"></span></a>
                                            </div>
                                        </td>
                                    {% endif %}
                                    <td>
                                        {% if currency.enabled == false %}
                                        <span class="text-muted">
                                        {% endif %}
                                            {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                        {% if currency.id == defaultCurrency.id %}
                                            <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                        {% endif %}
                                            {% if currency.enabled == false %}
                                        </span>
                                    <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                        {% endif %}
                                    </td>

                                    <td>{{ currency.decimal_places }}</td>
                                    <td class="buttons">
                                        <div class="btn-group">
                                            {% if currency.id != defaultCurrency.id %}
                                                <button data-id="{{ currency.id }}" class="make_default btn btn-default"><span
                                                            class="fa fa-fw fa-star"></span> {{ 'make_default_currency'|_ }}</button>
                                            {% endif %}
                                            {% if currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.disable',currency.id) }}">
                                                    <span class="fa fa-fw fa-square-o"></span>
                                                    {{ 'disable_currency'|_ }}</a>
                                            {% endif %}
                                            {% if not currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.enable',currency.id) }}">
                                                    <span class="fa fa-fw fa-check-square-o"></span>
                                                    {{ 'enable_currency'|_ }}</a>
                                            {% endif %}
                                        </div>
                                    </td>
                                </tr>
                            {% endfor %}
                            </tbody>
                        </table>
                        <div style="padding-left:8px;">
                            {{ currencies.links('v1.pagination.bootstrap-4')|raw }}
                        </div>
                    {% endif %}
                </div>
                <div class="box-footer">
                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                </div>
            </div>
        </div>
    </div>
{% endblock %}
{% block scripts %}
    <script type="text/javascript" nonce="{{ JS_NONCE }}">
        var makeDefaultUrl = "{{ route('currencies.default') }}";
    </script>
    <script type="text/javascript" src="v1/js/ff/currencies/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% endblock %}