Program: CWE-79
Project: CVE-2014-3840
Buggy source:
{% load i18n %}
{% load attribute_tags %}
{% load pagination_tags %}
{% load navigation_tags %}
{% load non_breakable %}
{% load variable_tags %}
{% load main_settings_tags %}
{% load multiselect_tags %}

{% get_main_setting "DISABLE_ICONS" as disable_icons %}

{% if side_bar %}
    <div class="block">
    <h3>
        {{ title|capfirst }}
    </h3>
    <div class="content">
        <p>
{% else %}    
    {% autopaginate object_list %} 
    <div class="content">
    <h2 class="title">
        {% ifnotequal page_obj.paginator.num_pages 1 %}
            {% blocktrans with page_obj.start_index as start and page_obj.end_index as end and page_obj.paginator.object_list|length as total and page_obj.number as page_number and page_obj.paginator.num_pages as total_pages %}List of {{ title }} ({{ start }} - {{ end }} out of {{ total }}) (Page {{ page_number }} of {{ total_pages }}){% endblocktrans %}
        {% else %}
            {% blocktrans with page_obj.paginator.object_list|length as total %}List of {{ title }} ({{ total }}){% endblocktrans %}
        {% endifnotequal %}
    </h2>

    <div class="inner">
{% endif %}

        <form action="{% url multi_object_action_view %}" class="form multi_select" method="get">

            {% if object_list %}
                {% if multi_select or multi_select_as_buttons %}
                    {% if multi_select_as_buttons %}
                        {% get_multi_item_links as multi_item_links %}
                        <div class="group navform wat-cf" style="margin-bottom: 0px;">
                        {% for link in multi_item_links %}
                            <button class="button" type="submit" name="action" value="{{ link.url }}" style="margin-bottom: 8px;">
                               {% if link.famfam and not disable_icons %}<span class="famfam active famfam-{{ link.famfam|default:'link' }}"></span>{% endif %}{{ link.text|capfirst }}
                            </button>
                        {% endfor %}
                        </div>
                    {% else %}
                        {% with "true" as form_hide_required_text %}
                            {% get_multi_item_links_form %}
                        {% endwith %}
                        <div class="group navform wat-cf">
                            <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                            </button>
                        </div>
                    {% endif %}
                {% endif %}          
            {% endif %}          
        
            {% if scrollable_content %}
                <div style="border: 1px solid; height: {{ scrollable_content_height }}; overflow: auto;">
            {% endif %}

            <table class="table">
                <tbody>
                    {% if not hide_header %}
                        <tr>
                            {% if multi_select or multi_select_as_buttons %}
                                <th class="first"><input type="checkbox" class="checkbox toggle" /></th>
                            {% endif %}

                            {% if not hide_object %}
                                <th>{% trans "Identifier" %}</th>
                            {% endif %}

                            {% for column in extra_columns_preffixed %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}

                            {% for column in object_list.0|get_model_list_columns %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}            

                            {% for column in extra_columns %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}        

                            {% if not hide_links %}
                                <th class="">&nbsp;</th>
                            {% endif %}
                        </tr>
                    {% endif %}
                    {% for object in object_list %}
                        <tr class="{% cycle 'odd' 'even2' %}">
                        {% if multi_select or multi_select_as_buttons %}    
                            <td>
                            {% if multi_select_item_properties %}
                                <input type="checkbox" class="checkbox" name="properties_{{ object|get_encoded_parameter:multi_select_item_properties }}" value="" />
                            {% else %}
                                <input type="checkbox" class="checkbox" name="pk_{{ object.pk }}" value="" />
                            {% endif %}
                            </td>
                        {% endif %}
                        {% if not hide_object %}
                            {% if main_object %}
                                {% with object|object_property:main_object as object %}
                                    <td>{% if not hide_link %}<a href="{{ object.get_absolute_url }}">{{ object }}</a>{% else %}{{ object }}{% endif %}</td>
                                {% endwith %}
                            {% else %}
                                <td>{% if not hide_link %}<a href="{{ object.get_absolute_url }}">{{ object }}</a>{% else %}{{ object }}{% endif %}</td>
                            {% endif %}
                        {% endif %}
                        {% for column in extra_columns_preffixed %}
                            {% if column.keep_together %}
                                <td>
                                    {{ object|object_property:column.attribute|make_non_breakable }}
                                </td>
                            {% else %}
                                <td>{{ object|object_property:column.attribute }}</td>
                            {% endif %}
                        {% endfor %}                        
                        {% if not hide_columns %}
                            {% for column in object|get_model_list_columns %}
                                <td>{{ object|object_property:column.attribute }}</td>
                            {% endfor %}
                        {% endif %}
                            {% for column in extra_columns %}
                                {% if column.keep_together %}
                                    <td>
                                        {{ object|object_property:column.attribute|make_non_breakable }}
                                    </td>
                                {% else %}
                                    <td>{{ object|object_property:column.attribute }}</td>
                                {% endif %}
                            {% endfor %}
                            {% if not hide_links %}
                                {% if list_object_variable_name %}
                                    {% copy_variable object as list_object_variable_name %}
                                    {% copy_variable list_object_variable_name as "navigation_object_name" %}
                                {% endif %}
                                <td class="last">
                                    {% if navigation_object_links %}
                                        {% with navigation_object_links as overrided_object_links %}
                                            {% object_navigation_template %}
                                        {% endwith %}
                                    {% else %}
                                        {% object_navigation_template %}
                                    {% endif %}
                                </td>
                            {% endif %}
                        </tr>
                    {% empty %}
                        <tr><td colspan=99 class="tc">{% blocktrans with title|striptags as stripped_title %}There are no {{ stripped_title }}{% endblocktrans %}</td></tr>
                    {% endfor %}
                </tbody>
            </table>
            
            {% if scrollable_content %}
                </div>            
            {% endif %}            
            
            {% if object_list %}
                {% if multi_select or multi_select_as_buttons %}
                    {% if multi_select_as_buttons %}
                        {% get_multi_item_links as multi_item_links %}
                        <div class="group navform wat-cf" style="margin-bottom: 0px;">
                        {% for link in multi_item_links %}
                            <button class="button" type="submit" name="action" value="{{ link.url }}" style="margin-bottom: 8px;">
                               {% if link.famfam and not disable_icons %}<span class="famfam active famfam-{{ link.famfam|default:'link' }}"></span>{% endif %}{{ link.text|capfirst }}
                            </button>
                        {% endfor %}
                        </div>
                    {% else %}
                        {% with "true" as form_hide_required_text %}
                            {% get_multi_item_links_form %}
                        {% endwith %}
                        <div class="group navform wat-cf">
                            <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                            </button>
                        </div>
                    {% endif %}
                {% endif %}  
            {% endif %}  
        </form>
        {% paginate %}
        
        {% if side_bar %}
            </p>
        {% endif %} 
    </div>
</div>


Fixed version (ground truth):
{% load i18n %}
{% load attribute_tags %}
{% load pagination_tags %}
{% load navigation_tags %}
{% load non_breakable %}
{% load variable_tags %}
{% load main_settings_tags %}
{% load multiselect_tags %}

{% get_main_setting "DISABLE_ICONS" as disable_icons %}

{% if side_bar %}
    <div class="block">
    <h3>
        {{ title|capfirst }}
    </h3>
    <div class="content">
        <p>
{% else %}
    {% autopaginate object_list %}
    <div class="content">
    <h2 class="title">
        {% ifnotequal page_obj.paginator.num_pages 1 %}
            {% blocktrans with page_obj.start_index as start and page_obj.end_index as end and page_obj.paginator.object_list|length as total and page_obj.number as page_number and page_obj.paginator.num_pages as total_pages %}List of {{ title }} ({{ start }} - {{ end }} out of {{ total }}) (Page {{ page_number }} of {{ total_pages }}){% endblocktrans %}
        {% else %}
            {% blocktrans with page_obj.paginator.object_list|length as total %}List of {{ title }} ({{ total }}){% endblocktrans %}
        {% endifnotequal %}
    </h2>

    <div class="inner">
{% endif %}

        <form action="{% url multi_object_action_view %}" class="form multi_select" method="get">

            {% if object_list %}
                {% if multi_select or multi_select_as_buttons %}
                    {% if multi_select_as_buttons %}
                        {% get_multi_item_links as multi_item_links %}
                        <div class="group navform wat-cf" style="margin-bottom: 0px;">
                        {% for link in multi_item_links %}
                            <button class="button" type="submit" name="action" value="{{ link.url }}" style="margin-bottom: 8px;">
                               {% if link.famfam and not disable_icons %}<span class="famfam active famfam-{{ link.famfam|default:'link' }}"></span>{% endif %}{{ link.text|capfirst }}
                            </button>
                        {% endfor %}
                        </div>
                    {% else %}
                        {% with "true" as form_hide_required_text %}
                            {% get_multi_item_links_form %}
                        {% endwith %}
                        <div class="group navform wat-cf">
                            <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                            </button>
                        </div>
                    {% endif %}
                {% endif %}
            {% endif %}

            {% if scrollable_content %}
                <div style="border: 1px solid; height: {{ scrollable_content_height }}; overflow: auto;">
            {% endif %}

            <table class="table">
                <tbody>
                    {% if not hide_header %}
                        <tr>
                            {% if multi_select or multi_select_as_buttons %}
                                <th class="first"><input type="checkbox" class="checkbox toggle" /></th>
                            {% endif %}

                            {% if not hide_object %}
                                <th>{% trans "Identifier" %}</th>
                            {% endif %}

                            {% for column in extra_columns_preffixed %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}

                            {% for column in object_list.0|get_model_list_columns %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}

                            {% for column in extra_columns %}
                                <th>{{ column.name|capfirst }}</th>
                            {% endfor %}

                            {% if not hide_links %}
                                <th class="">&nbsp;</th>
                            {% endif %}
                        </tr>
                    {% endif %}
                    {% for object in object_list %}
                        <tr class="{% cycle 'odd' 'even2' %}">
                        {% if multi_select or multi_select_as_buttons %}
                            <td>
                            {% if multi_select_item_properties %}
                                <input type="checkbox" class="checkbox" name="properties_{{ object|get_encoded_parameter:multi_select_item_properties }}" value="" />
                            {% else %}
                                <input type="checkbox" class="checkbox" name="pk_{{ object.pk }}" value="" />
                            {% endif %}
                            </td>
                        {% endif %}
                        {% if not hide_object %}
                            {% if main_object %}
                                {% with object|object_property:main_object as object %}
                                    <td>{% if not hide_link %}<a href="{{ object.get_absolute_url }}">{{ object }}</a>{% else %}{{ object }}{% endif %}</td>
                                {% endwith %}
                            {% else %}
                                <td>{% if not hide_link %}<a href="{{ object.get_absolute_url }}">{{ object }}</a>{% else %}{{ object }}{% endif %}</td>
                            {% endif %}
                        {% endif %}
                        {% for column in extra_columns_preffixed %}
                            {% if column.keep_together %}
                                <td>
                                    {{ object|object_property:column.attribute|make_non_breakable }}
                                </td>
                            {% else %}
                                <td>{{ object|object_property:column.attribute }}</td>
                            {% endif %}
                        {% endfor %}
                        {% if not hide_columns %}
                            {% for column in object|get_model_list_columns %}
                                <td>{{ object|object_property:column.attribute }}</td>
                            {% endfor %}
                        {% endif %}
                            {% for column in extra_columns %}
                                {% if column.keep_together %}
                                    <td>
                                        {{ object|object_property:column.attribute|make_non_breakable }}
                                    </td>
                                {% else %}
                                    <td>{{ object|object_property:column.attribute }}</td>
                                {% endif %}
                            {% endfor %}
                            {% if not hide_links %}
                                {% if list_object_variable_name %}
                                    {% copy_variable object as list_object_variable_name %}
                                    {% copy_variable list_object_variable_name as "navigation_object_name" %}
                                {% endif %}
                                <td class="last">
                                    {% if navigation_object_links %}
                                        {% with navigation_object_links as overrided_object_links %}
                                            {% object_navigation_template %}
                                        {% endwith %}
                                    {% else %}
                                        {% object_navigation_template %}
                                    {% endif %}
                                </td>
                            {% endif %}
                        </tr>
                    {% empty %}
                        <tr><td colspan=99 class="tc">{% blocktrans with title as title %}There are no {{ title }}{% endblocktrans %}</td></tr>
                    {% endfor %}
                </tbody>
            </table>

            {% if scrollable_content %}
                </div>
            {% endif %}

            {% if object_list %}
                {% if multi_select or multi_select_as_buttons %}
                    {% if multi_select_as_buttons %}
                        {% get_multi_item_links as multi_item_links %}
                        <div class="group navform wat-cf" style="margin-bottom: 0px;">
                        {% for link in multi_item_links %}
                            <button class="button" type="submit" name="action" value="{{ link.url }}" style="margin-bottom: 8px;">
                               {% if link.famfam and not disable_icons %}<span class="famfam active famfam-{{ link.famfam|default:'link' }}"></span>{% endif %}{{ link.text|capfirst }}
                            </button>
                        {% endfor %}
                        </div>
                    {% else %}
                        {% with "true" as form_hide_required_text %}
                            {% get_multi_item_links_form %}
                        {% endwith %}
                        <div class="group navform wat-cf">
                            <button class="button" type="submit" name="{{ form.prefix }}-submit">
                                <img src="{{ STATIC_URL }}web_theme_media/images/icons/tick.png" alt="{% if object %}{% trans 'Save' %}{% else %}{% trans 'Submit' %}{% endif %}" /> {% if object %}{% trans "Save" %}{% else %}{% trans "Submit" %}{% endif %}
                            </button>
                        </div>
                    {% endif %}
                {% endif %}
            {% endif %}
        </form>
        {% paginate %}

        {% if side_bar %}
            </p>
        {% endif %}
    </div>
</div>