Program: CWE-79
Project: CVE-2016-9126
Buggy source:
{*<!--

+---------------------------------------------------------------------------+
| Revive Adserver                                                           |
| http://www.revive-adserver.com                                            |
|                                                                           |
| Copyright: See the COPYRIGHT.txt file.                                    |
| License: GPLv2 or later, see the LICENSE.txt file.                        |
+---------------------------------------------------------------------------+

-->*}<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>{t str=AuditTrail}</title>
  <link rel='stylesheet' type='text/css' href='{$assetPath}/css/dashboard-widget.css'>
  <!--[if IE]>
      <link rel="stylesheet" type="text/css" href="{$assetPath}/css/dashboard-widget-ie.css" />
  <![endif]-->
</head>

<body>

{if $screen == 'enabled'}
    {if $aAuditData|@count > 0}
    <div class="widgetListWrapper widgetContainer">
        <!-- normal view -->
        <ul class="widgetList auditList">
           {foreach from=$aAuditData key=key item=aValue}
            <li>
                <div class="title">
                    <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">
                        {$aValue.desc}
                    </a>
                </div>
                <div>
                    <span class="date">{$aValue.updated|date_format:"%d %b %Y"}</span>
                </div>
            </li>
            {/foreach}
        </ul>
    </div>
    <div><a class="site-link" target="_top" href="{$siteUrl}">{$siteTitle}</a></div>
    {else}
    <div class="widgetListWrapper widgetContainer">
      <ul class="widgetList auditList">
        <li>{$noData}</li>
      </ul>
    </div>
    {/if}
{else}
    <div class="widgetListWrapper widgetContainer">
        <ul class="widgetList auditList">
            {t str=AuditTrailNotEnabled}
        </ul>
    </div>
    <div><a class="site-link" target="_top" href="{$siteUrl}">{$siteTitle}</a></div>
    {/if}
</body>
</html>


Fixed version (ground truth):
{*<!--

+---------------------------------------------------------------------------+
| Revive Adserver                                                           |
| http://www.revive-adserver.com                                            |
|                                                                           |
| Copyright: See the COPYRIGHT.txt file.                                    |
| License: GPLv2 or later, see the LICENSE.txt file.                        |
+---------------------------------------------------------------------------+

-->*}<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>{t str=AuditTrail}</title>
  <link rel='stylesheet' type='text/css' href='{$assetPath}/css/dashboard-widget.css'>
  <!--[if IE]>
      <link rel="stylesheet" type="text/css" href="{$assetPath}/css/dashboard-widget-ie.css" />
  <![endif]-->
</head>

<body>

{if $screen == 'enabled'}
    {if $aAuditData|@count > 0}
    <div class="widgetListWrapper widgetContainer">
        <!-- normal view -->
        <ul class="widgetList auditList">
           {foreach from=$aAuditData key=key item=aValue}
            <li>
                <div class="title">
                    <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">
                        {$aValue.desc|escape}
                    </a>
                </div>
                <div>
                    <span class="date">{$aValue.updated|date_format:"%d %b %Y"}</span>
                </div>
            </li>
            {/foreach}
        </ul>
    </div>
    <div><a class="site-link" target="_top" href="{$siteUrl}">{$siteTitle}</a></div>
    {else}
    <div class="widgetListWrapper widgetContainer">
      <ul class="widgetList auditList">
        <li>{$noData}</li>
      </ul>
    </div>
    {/if}
{else}
    <div class="widgetListWrapper widgetContainer">
        <ul class="widgetList auditList">
            {t str=AuditTrailNotEnabled}
        </ul>
    </div>
    <div><a class="site-link" target="_top" href="{$siteUrl}">{$siteTitle}</a></div>
    {/if}
</body>
</html>