nus-yam/ex-repair huggingface dataset:
Program: CWE-79
Project: CVE-2021-21283
Buggy source:
import { extend } from 'flarum/extend';
import DiscussionListState from 'flarum/states/DiscussionListState';
import DiscussionListItem from 'flarum/components/DiscussionListItem';
import DiscussionPage from 'flarum/components/DiscussionPage';
import IndexPage from 'flarum/components/IndexPage';
import { truncate } from 'flarum/utils/string';

export default function addStickyControl() {
  extend(DiscussionListState.prototype, 'requestParams', function(params) {
    if (app.current.matches(IndexPage) || app.current.matches(DiscussionPage)) {
      params.include.push('firstPost');
    }
  });

  extend(DiscussionListItem.prototype, 'infoItems', function(items) {
    const discussion = this.attrs.discussion;

    if (discussion.isSticky() && !this.attrs.params.q && !discussion.lastReadPostNumber()) {
      const firstPost = discussion.firstPost();

      if (firstPost) {
        const excerpt = truncate(firstPost.contentPlain(), 175);

        items.add('excerpt', m.trust(excerpt), -100);
      }
    }
  });
}


Fixed version (ground truth):
import { extend } from 'flarum/extend';
import DiscussionListState from 'flarum/states/DiscussionListState';
import DiscussionListItem from 'flarum/components/DiscussionListItem';
import DiscussionPage from 'flarum/components/DiscussionPage';
import IndexPage from 'flarum/components/IndexPage';
import { truncate } from 'flarum/utils/string';

export default function addStickyControl() {
  extend(DiscussionListState.prototype, 'requestParams', function(params) {
    if (app.current.matches(IndexPage) || app.current.matches(DiscussionPage)) {
      params.include.push('firstPost');
    }
  });

  extend(DiscussionListItem.prototype, 'infoItems', function(items) {
    const discussion = this.attrs.discussion;

    if (discussion.isSticky() && !this.attrs.params.q && !discussion.lastReadPostNumber()) {
      const firstPost = discussion.firstPost();

      if (firstPost) {
        const excerpt = truncate(firstPost.contentPlain(), 175);

        // Wrapping in <div> because ItemList entries need to be vnodes
        items.add('excerpt', <div>{excerpt}</div>, -100);
      }
    }
  });
}
Program: CWE-79
Project: CVE-2021-23445
Buggy source:
{
    "js": [
        "js/jquery.dataTables.js",
        "js/jquery.dataTables.min.js"
    ],
    "css": [],
    "types": [
        "types/types.d.ts"
    ],
    "src-repo": "http://github.com/DataTables/DataTablesSrc",
    "last-tag": "1.11.2",
    "last-sync": "ea607c6e51e76d13efc341b5d41f5082a33b56e0"
}

Fixed version (ground truth):
{
    "js": [
        "js/jquery.dataTables.js",
        "js/jquery.dataTables.min.js"
    ],
    "css": [],
    "types": [
        "types/types.d.ts"
    ],
    "src-repo": "http://github.com/DataTables/DataTablesSrc",
    "last-tag": "1.11.2",
    "last-sync": "e835ddc5b800c47f7e9e32a91cc522f8ca7ced5c"
}
Program: CWE-79
Project: CVE-2021-25964
Buggy source:
# GDrive Integration
gevent>20.6.0,<21.2.0
greenlet>=0.4.17,<1.2.0
httplib2>=0.9.2,<0.20.0
oauth2client>=4.0.0,<4.1.4
uritemplate>=3.0.0,<3.1.0
pyasn1-modules>=0.0.8,<0.3.0
pyasn1>=0.1.9,<0.5.0
PyDrive2>=1.3.1,<1.9.0
PyYAML>=3.12
rsa>=3.4.2,<4.8.0
six>=1.10.0,<1.17.0

# Gdrive and Gmail integration
google-api-python-client>=1.7.11,<2.1.0

# Gmail
google-auth-oauthlib>=0.4.3,<0.5.0

# goodreads
goodreads>=0.3.2,<0.4.0
python-Levenshtein>=0.12.0,<0.13.0

# ldap login
python-ldap>=3.0.0,<3.4.0
Flask-SimpleLDAP>=1.4.0,<1.5.0

#oauth
Flask-Dance>=2.0.0,<5.1.0
SQLAlchemy-Utils>=0.33.5,<0.38.0

# extracting metadata
lxml>=3.8.0,<4.7.0
rarfile>=2.7
scholarly>=1.2.0, <1.3

# other
natsort>=2.2.0,<7.2.0
comicapi>= 2.2.0,<2.3.0

#Kobo integration
jsonschema>=3.2.0,<3.3.0


Fixed version (ground truth):
# GDrive Integration
gevent>20.6.0,<21.2.0
greenlet>=0.4.17,<1.2.0
httplib2>=0.9.2,<0.20.0
oauth2client>=4.0.0,<4.1.4
uritemplate>=3.0.0,<3.1.0
pyasn1-modules>=0.0.8,<0.3.0
pyasn1>=0.1.9,<0.5.0
PyDrive2>=1.3.1,<1.9.0
PyYAML>=3.12
rsa>=3.4.2,<4.8.0
six>=1.10.0,<1.17.0

# Gdrive and Gmail integration
google-api-python-client>=1.7.11,<2.1.0

# Gmail
google-auth-oauthlib>=0.4.3,<0.5.0

# goodreads
goodreads>=0.3.2,<0.4.0
python-Levenshtein>=0.12.0,<0.13.0

# ldap login
python-ldap>=3.0.0,<3.4.0
Flask-SimpleLDAP>=1.4.0,<1.5.0

#oauth
Flask-Dance>=2.0.0,<5.1.0
SQLAlchemy-Utils>=0.33.5,<0.38.0

# extracting metadata
rarfile>=2.7
scholarly>=1.2.0, <1.3

# other
natsort>=2.2.0,<7.2.0
comicapi>= 2.2.0,<2.3.0

#Kobo integration
jsonschema>=3.2.0,<3.3.0
Program: CWE-79
Project: CVE-2021-25975
Buggy source:
# frozen_string_literal: true

require "marcel"

class ResourceUploader < CarrierWave::Uploader::Base
  include CarrierWave::MiniMagick
  before :cache, :check_image_content_type!

  def store_dir
    "files/#{model.class.to_s.underscore}/#{model.id}"
  end

  version :thumb, if: :image? do
    process dynamic_resize_to_fit: :thumb
  end

  version :medium, if: :image? do
    process dynamic_resize_to_fit: :medium
  end

  version :avatar, if: :image? do
    process dynamic_resize_to_fit: :avatar
  end

  def dynamic_resize_to_fit(size)
    resize_setting = model.blog.send("image_#{size}_size").to_i

    resize_to_fit(resize_setting, resize_setting)
  end

  def image?(new_file)
    content_type = new_file.content_type
    content_type&.include?("image")
  end

  def check_image_content_type!(new_file)
    if image?(new_file)
      magic_type = mime_magic_content_type(new_file)
      if magic_type != new_file.content_type
        raise CarrierWave::IntegrityError, "has MIME type mismatch"
      end
    end
  end

  private

  # NOTE: This method was adapted from MagicMimeBlacklist#extract_content_type
  # from CarrierWave 1.0.0 and SanitizedFile#mime_magic_content_type from CarrierWave 0.11.2
  def mime_magic_content_type(new_file)
    content_type = nil

    File.open(new_file.path) do |fd|
      content_type = Marcel::MimeType.for(fd)
    end

    content_type
  end
end


Fixed version (ground truth):
# frozen_string_literal: true

require "marcel"

class ResourceUploader < CarrierWave::Uploader::Base
  include CarrierWave::MiniMagick
  before :cache, :check_image_content_type!

  def content_type_allowlist
    [%r{image/}, %r{audio/}, %r{video/}, "text/plain"]
  end

  def store_dir
    "files/#{model.class.to_s.underscore}/#{model.id}"
  end

  version :thumb, if: :image? do
    process dynamic_resize_to_fit: :thumb
  end

  version :medium, if: :image? do
    process dynamic_resize_to_fit: :medium
  end

  version :avatar, if: :image? do
    process dynamic_resize_to_fit: :avatar
  end

  def dynamic_resize_to_fit(size)
    resize_setting = model.blog.send("image_#{size}_size").to_i

    resize_to_fit(resize_setting, resize_setting)
  end

  def image?(new_file)
    content_type = new_file.content_type
    content_type&.include?("image")
  end

  def check_image_content_type!(new_file)
    if image?(new_file)
      magic_type = mime_magic_content_type(new_file)
      if magic_type != new_file.content_type
        raise CarrierWave::IntegrityError, "has MIME type mismatch"
      end
    end
  end

  private

  # NOTE: This method was adapted from MagicMimeBlacklist#extract_content_type
  # from CarrierWave 1.0.0 and SanitizedFile#mime_magic_content_type from CarrierWave 0.11.2
  def mime_magic_content_type(new_file)
    content_type = nil

    File.open(new_file.path) do |fd|
      content_type = Marcel::MimeType.for(fd)
    end

    content_type
  end
end
Program: CWE-79
Project: CVE-2021-25989
Buggy source:
// @flow
import LazyLoad from 'react-lazyload';
import React from 'react';
import css from './Avatar.scss';

export type Props = {
  name?: string,
  src?: string,
  alt?: string,
  small?: boolean,
  large?: boolean,
};

const displayImage = (alt: ?string, src: string) => (
  <img alt={alt ?? ''} className={`${css.image}`} src={src} />
);

const displayName = (name: string) => (
  <div className={`${css.name} name`}>{name}</div>
);

const getHeight = (small: ?boolean, large: ?boolean) => {
  if (small) return 50;
  if (large) return 150;
  return 100;
};

export const Avatar = (props: Props) => {
  const {
    name, alt, src, small, large,
  } = props;
  const height = getHeight(small, large);
  return (
    <div
      className={`avatar ${css.avatar} ${large ? css.large : ''} ${small ? css.small : ''}`}
    >
      <LazyLoad height={height} offset={height} once tabIndex={0}>
        {src ? (
          displayImage(alt, src)
        ) : (
          <div className={css.image} aria-hidden />
        )}
      </LazyLoad>
      {name && displayName(name)}
    </div>
  );
};


Fixed version (ground truth):
// @flow
import LazyLoad from 'react-lazyload';
import React from 'react';
import css from './Avatar.scss';

export type Props = {
  name?: string,
  src?: string,
  alt?: string,
  small?: boolean,
  large?: boolean,
};

const displayImage = (alt: ?string, src: string) => (
  <img alt={alt ?? ''} className={`${css.image}`} src={src} />
);

const displayName = (name: string) => (
  <div className={`${css.name} name`}>{name}</div>
);

const getHeight = (small: ?boolean, large: ?boolean) => {
  if (small) return 50;
  if (large) return 150;
  return 100;
};

export const Avatar = (props: Props) => {
  const {
    name, alt, src, small, large,
  } = props;
  const height = getHeight(small, large);
  return (
    <div
      className={`avatar ${css.avatar} ${large ? css.large : ''} ${
        small ? css.small : ''
      }`}
    >
      <LazyLoad height={height} offset={height} once tabIndex={0}>
        {src ? (
          displayImage(alt, src)
        ) : (
          <div className={css.image} aria-hidden />
        )}
      </LazyLoad>
      {name && displayName(name)}
    </div>
  );
};
Program: CWE-79
Project: CVE-2021-25990
Buggy source:
// @flow
import axios from 'axios';
import renderHTML from 'react-render-html';

const randomString = () => Math.random()
  .toString(36)
  .substring(2, 15)
  + Math.random()
    .toString(36)
    .substring(2, 15);

const setCsrfToken = () => {
  const tokenDom = document.querySelector('meta[name=csrf-token]');
  if (tokenDom) {
    const csrfToken = tokenDom.getAttribute('content');
    axios.defaults.headers.common['X-CSRF-Token'] = csrfToken;
  }
};

const getPusher = () => {
  if (window.Pusher) {
    const metaPusherKey = Array.from(
      window.document.getElementsByTagName('meta'),
    ).filter((item) => item.getAttribute('name') === 'pusher-key')[0];
    const metaPusherCluster = Array.from(
      window.document.getElementsByTagName('meta'),
    ).filter((item) => item.getAttribute('name') === 'pusher-cluster')[0];
    return new window.Pusher(metaPusherKey.getAttribute('content'), {
      cluster: metaPusherCluster.getAttribute('content'),
    });
  }
  return null;
};

const renderContent = (content: string | any) => {
  if (typeof content === 'string') {
    return renderHTML(content);
  }
  return content;
};

export const Utils = {
  randomString,
  setCsrfToken,
  getPusher,
  renderContent,
};


Fixed version (ground truth):
// @flow
import axios from 'axios';
import renderHTML from 'react-render-html';
import { sanitize } from 'dompurify';

const randomString = () => Math.random()
  .toString(36)
  .substring(2, 15)
  + Math.random()
    .toString(36)
    .substring(2, 15);

const setCsrfToken = () => {
  const tokenDom = document.querySelector('meta[name=csrf-token]');
  if (tokenDom) {
    const csrfToken = tokenDom.getAttribute('content');
    axios.defaults.headers.common['X-CSRF-Token'] = csrfToken;
  }
};

const getPusher = () => {
  if (window.Pusher) {
    const metaPusherKey = Array.from(
      window.document.getElementsByTagName('meta'),
    ).filter((item) => item.getAttribute('name') === 'pusher-key')[0];
    const metaPusherCluster = Array.from(
      window.document.getElementsByTagName('meta'),
    ).filter((item) => item.getAttribute('name') === 'pusher-cluster')[0];
    return new window.Pusher(metaPusherKey.getAttribute('content'), {
      cluster: metaPusherCluster.getAttribute('content'),
    });
  }
  return null;
};

const renderContent = (content: string | any) => {
  if (typeof content === 'string') {
    return renderHTML(sanitize(content));
  }
  return content;
};

export const Utils = {
  randomString,
  setCsrfToken,
  getPusher,
  renderContent,
};
Program: CWE-79
Project: CVE-2021-32641
Buggy source:
// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`EmailInput renders without issue 1`] = `"<div data-__type=\\"input_wrap\\" data-invalidhint=\\"invalidHint\\" data-isvalid=\\"true\\" data-name=\\"email\\" data-icon=\\"<svg aria-hidden=&quot;true&quot; focusable=&quot;false&quot; width=&quot;14px&quot; height=&quot;13px&quot; viewBox=&quot;0 0 32 26&quot; version=&quot;1.1&quot; xmlns=&quot;http://www.w3.org/2000/svg&quot; xmlns:xlink=&quot;http://www.w3.org/1999/xlink&quot; xmlns:sketch=&quot;http://www.bohemiancoding.com/sketch/ns&quot; class=&quot;auth0-lock-icon auth0-lock-icon-box&quot;><g id=&quot;Page-1&quot; stroke=&quot;none&quot; stroke-width=&quot;1&quot; fill=&quot;none&quot; fill-rule=&quot;evenodd&quot; sketch:type=&quot;MSPage&quot;><g id=&quot;32px&quot; sketch:type=&quot;MSLayerGroup&quot; transform=&quot;translate(-2155.000000, -2317.000000)&quot; fill=&quot;#373A39&quot;><g id=&quot;Group-856&quot; transform=&quot;translate(1.000000, 1.000000)&quot; sketch:type=&quot;MSShapeGroup&quot;><path id=&quot;Fill-419&quot; d=&quot;M2184,2339 C2184,2339.55 2183.55,2340 2183,2340 L2157,2340 C2156.45,2340 2156,2339.55 2156,2339 L2156,2319 C2156,2318.45 2156.45,2318 2157,2318 L2183,2318 C2183.55,2318 2184,2318.45 2184,2319 L2184,2339 L2184,2339 Z M2184,2316 L2156,2316 C2154.89,2316 2154,2316.89 2154,2318 L2154,2340 C2154,2341.1 2154.89,2342 2156,2342 L2184,2342 C2185.1,2342 2186,2341.1 2186,2340 L2186,2318 C2186,2316.89 2185.1,2316 2184,2316 L2184,2316 Z M2176,2322 L2180,2322 L2180,2326 L2176,2326 L2176,2322 Z M2174,2328 L2182,2328 L2182,2320 L2174,2320 L2174,2328 Z M2158,2332 L2172,2332 L2172,2330 L2158,2330 L2158,2332 Z M2158,2336 L2172,2336 L2172,2334 L2158,2334 L2158,2336 Z&quot;></path></g></g></g></svg>\\"><input type=\\"email\\" id=\\"1-email\\" inputmode=\\"email\\" name=\\"email\\" class=\\"auth0-lock-input\\" placeholder=\\"yours@example.com\\" autocomplete=\\"off\\" autocapitalize=\\"off\\" aria-label=\\"Email\\" aria-invalid=\\"false\\" value=\\"value\\"></div>"`;


Fixed version (ground truth):
// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`EmailInput renders without issue 1`] = `"<div data-__type=\\"input_wrap\\" data-invalidhint=\\"invalidHint\\" data-isvalid=\\"true\\" data-name=\\"email\\" data-icon=\\"[object Object]\\"><input type=\\"email\\" id=\\"1-email\\" inputmode=\\"email\\" name=\\"email\\" class=\\"auth0-lock-input\\" placeholder=\\"yours@example.com\\" autocomplete=\\"off\\" autocapitalize=\\"off\\" aria-label=\\"Email\\" aria-invalid=\\"false\\" value=\\"value\\"></div>"`;
Program: CWE-79
Project: CVE-2021-32798
Buggy source:
{
  "name": "jupyter-notebook-deps",
  "private": true,
  "version": "4.0.0",
  "description": "Jupyter Notebook nodejs dependencies",
  "author": "Jupyter Developers",
  "license": "BSD-3-Clause",
  "repository": {
    "type": "git",
    "url": "https://github.com/jupyter/notebook.git"
  },
  "scripts": {
    "bower": "bower install",
    "build": "python setup.py js css",
    "build:watch": "npm run watch",
    "watch": "onchange 'notebook/static/**/!(*.min).js' 'notebook/static/**/*.less' 'bower.json' -- npm run build"
  },
  "devDependencies": {
    "bower": "^1.8.8",
    "less": "~2",
    "onchange": "^6.0.0",
    "po2json": "^0.4.5",
    "requirejs": "^2.3.6"
  }
}


Fixed version (ground truth):
{
  "name": "jupyter-notebook-deps",
  "private": true,
  "version": "4.0.0",
  "description": "Jupyter Notebook nodejs dependencies",
  "author": "Jupyter Developers",
  "license": "BSD-3-Clause",
  "repository": {
    "type": "git",
    "url": "https://github.com/jupyter/notebook.git"
  },
  "scripts": {
    "bower": "bower install",
    "build": "python setup.py js css",
    "build:webpack": "webpack --mode development",
    "build:watch": "npm run watch",
    "watch": "onchange 'notebook/static/**/!(*.min).js' 'notebook/static/**/*.less' 'bower.json' -- npm run build"
  },
  "devDependencies": {
    "@jupyterlab/apputils": "^3.1.3",
    "bower": "^1.8.8",
    "less": "~2",
    "onchange": "^6.0.0",
    "po2json": "^0.4.5",
    "requirejs": "^2.3.6",
    "webpack": "^5.46.0",
    "webpack-cli": "^4.7.2"
  }
}
Program: CWE-79
Project: CVE-2021-3377
Buggy source:
None

Fixed version (ground truth):
0.1
Program: CWE-79
Project: CVE-2021-37710
Buggy source:
# BEGIN Shopware
# The directives (lines) between "# BEGIN Shopware" and "# END Shopware" are dynamically generated. Any changes to the directives between these markers will be overwritten.

DirectoryIndex index.php

<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
    RewriteRule ^(.*) - [E=BASE:%1]

    # Sets the HTTP_AUTHORIZATION header removed by Apache
    RewriteCond %{HTTP:Authorization} .
    RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{ENV:REDIRECT_STATUS} ^$
    RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]

    # If the requested filename exists, simply serve it.
    # We only want to let Apache serve files and not directories.
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]

    # Rewrite all other queries to the front controller.
    RewriteRule ^ %{ENV:BASE}/index.php [L]
</IfModule>

<IfModule !mod_rewrite.c>
    <IfModule mod_alias.c>
        RedirectMatch 302 ^/$ /index.php/
    </IfModule>
</IfModule>

<IfModule mod_headers.c>
    <FilesMatch "\.svg$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>

# END Shopware


Fixed version (ground truth):
# BEGIN Shopware
# The directives (lines) between "# BEGIN Shopware" and "# END Shopware" are dynamically generated. Any changes to the directives between these markers will be overwritten.

DirectoryIndex index.php

<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
    RewriteRule ^(.*) - [E=BASE:%1]

    # Sets the HTTP_AUTHORIZATION header removed by Apache
    RewriteCond %{HTTP:Authorization} .
    RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{ENV:REDIRECT_STATUS} ^$
    RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]

    # If the requested filename exists, simply serve it.
    # We only want to let Apache serve files and not directories.
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]

    # Rewrite all other queries to the front controller.
    RewriteRule ^ %{ENV:BASE}/index.php [L]
</IfModule>

<IfModule !mod_rewrite.c>
    <IfModule mod_alias.c>
        RedirectMatch 302 ^/$ /index.php/
    </IfModule>
</IfModule>

<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>

# END Shopware
Program: CWE-79
Project: CVE-2021-3783
Buggy source:
<?php
/**
 * YOURLS version
 *
 */
define( 'YOURLS_VERSION', '1.8.3-dev' );

/**
 * YOURLS DB version. Increments when changes are made to the DB schema, to trigger a DB update
 *
 */
define( 'YOURLS_DB_VERSION', '506' );


Fixed version (ground truth):
<?php
/**
 * YOURLS version
 *
 * Must be one of the following :
 *    MAJOR.MINOR (eg 1.8)
 *    MAJOR.MINOR.PATCH (1.8.1)
 *    MAJOR.MINOR-SOMETHING (1.8-dev)
 *    MAJOR.MINOR.PATCH-SOMETHING (1.8.1-donotuse)
 *
 */
define( 'YOURLS_VERSION', '1.8.3-dev' );

/**
 * YOURLS DB version. Increments when changes are made to the DB schema, to trigger a DB update
 *
 * Must be a string of an integer.
 *
 */
define( 'YOURLS_DB_VERSION', '506' );
Program: CWE-79
Project: CVE-2021-39136
Buggy source:
<?php
/**
 * baserCMS :  Based Website Development Project <https://basercms.net>
 * Copyright (c) baserCMS Users Community <https://basercms.net/community/>
 *
 * @copyright       Copyright (c) baserCMS Users Community
 * @link            https://basercms.net baserCMS Project
 * @package            Uploader.View
 * @since           baserCMS v 3.0.10
 * @license         https://basercms.net/license/index.html
 */
$url = $this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name']));
?>


<p class="url">
	<a href="<?php echo $url ?>" target="_blank"><?php echo FULL_BASE_URL . $url ?></a>
</p>
<p class="image">
	<a href="<?php echo $url ?>"
	   target="_blank"><?php echo $this->Uploader->file($file, ['size' => $size, 'alt' => $file['UploaderFile']['name']]) ?></a>
</p>


Fixed version (ground truth):
<?php
/**
 * baserCMS :  Based Website Development Project <https://basercms.net>
 * Copyright (c) baserCMS Users Community <https://basercms.net/community/>
 *
 * @copyright       Copyright (c) baserCMS Users Community
 * @link            https://basercms.net baserCMS Project
 * @package         Uploader.View
 * @since           baserCMS v 3.0.10
 * @license         https://basercms.net/license/index.html
 */

/**
 * @var BcAppView $this
 * @var array $file
 * @var string $size
 */
$url = h($this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name'])));
?>


<p class="url">
	<a href="<?php echo $url ?>" target="_blank"><?php echo Router::url($url, true) ?></a>
</p>
<p class="image">
	<a href="<?php echo $url ?>"
	   target="_blank"><?php echo $this->Uploader->file($file, ['size' => $size, 'alt' => $file['UploaderFile']['name']]) ?></a>
</p>
Program: CWE-79
Project: CVE-2021-39286
Buggy source:
__version__ = '2.6.0b0'

if __name__ == '__main__':
    print(__version__)


Fixed version (ground truth):
__version__ = '2.6.0b1'

if __name__ == '__main__':
    print(__version__)
Program: CWE-79
Project: CVE-2021-3938
Buggy source:
__version__ = '2.6.0b0'

if __name__ == '__main__':
    print(__version__)


Fixed version (ground truth):
__version__ = '2.6.0b1'

if __name__ == '__main__':
    print(__version__)
Program: CWE-79
Project: CVE-2021-3985
Buggy source:
<?php

/*
 * This file is part of the Kimai time-tracking app.
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace App\Utils;

/**
 * A simple class to parse markdown syntax and return HTML.
 */
final class Markdown
{
    /**
     * @var ParsedownExtension
     */
    private $parser;

    public function __construct()
    {
        $this->parser = new ParsedownExtension();
        $this->parser->setUrlsLinked(true);
        $this->parser->setBreaksEnabled(true);
    }

    /**
     * @param string $text
     * @param bool $safe
     * @return string
     */
    public function toHtml(string $text, bool $safe = true): string
    {
        $this->parser->setSafeMode($safe);

        return $this->parser->text($text);
    }
}


Fixed version (ground truth):
<?php

/*
 * This file is part of the Kimai time-tracking app.
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace App\Utils;

/**
 * A simple class to parse markdown syntax and return HTML.
 */
final class Markdown
{
    /**
     * @var ParsedownExtension
     */
    private $parser;

    public function __construct()
    {
        $this->parser = new ParsedownExtension();
        $this->parser->setUrlsLinked(true);
        $this->parser->setBreaksEnabled(true);
    }

    /**
     * @param string $text
     * @param bool $safe
     * @return string
     */
    public function toHtml(string $text, bool $safe = true): string
    {
        if ($safe !== true) {
            @trigger_error('Only safe mode is supported in Markdown since 1.16.3 to prevent XSS attacks. Parameter $safe will be removed with 2.0', E_USER_DEPRECATED);
        }

        $this->parser->setSafeMode(true);
        $this->parser->setMarkupEscaped(true);

        return $this->parser->text($text);
    }
}
Program: CWE-79
Project: CVE-2021-4072
Buggy source:
<?php
/**
 * Elgg report action
 */
$title = get_input('title');
$description = get_input('description');
$address = get_input('address');
$access = ACCESS_PRIVATE; //this is private and only admins can see it

$fail = function () use ($address) {
	return elgg_error_response(elgg_echo('reportedcontent:failed'), $address);
};

if (!$title || !$address) {
	$fail();
}

$report = new ElggReportedContent();
$report->owner_guid = elgg_get_logged_in_user_guid();
$report->title = $title;
$report->address = $address;
$report->description = $description;
$report->access_id = $access;

if (!$report->save()) {
	$fail();
}

if (!elgg_trigger_plugin_hook('reportedcontent:add', 'system', ['report' => $report], true)) {
	$report->delete();
	$fail();
}

$report->state = 'active';

return elgg_ok_response('', elgg_echo('reportedcontent:success'), $address);


Fixed version (ground truth):
<?php
/**
 * Elgg report action
 */
$title = get_input('title');
$description = get_input('description');
$address = get_input('address');
$access = ACCESS_PRIVATE; //this is private and only admins can see it

$fail = function () use ($address) {
	return elgg_error_response(elgg_echo('reportedcontent:failed'), $address);
};

if (!$title || !$address) {
	$fail();
}

$report = new ElggReportedContent();
$report->owner_guid = elgg_get_logged_in_user_guid();
$report->title = $title;
$report->address = elgg_normalize_site_url($address);
$report->description = $description;
$report->access_id = $access;

if (!$report->save()) {
	$fail();
}

if (!elgg_trigger_plugin_hook('reportedcontent:add', 'system', ['report' => $report], true)) {
	$report->delete();
	$fail();
}

$report->state = 'active';

return elgg_ok_response('', elgg_echo('reportedcontent:success'), $address);
Program: CWE-79
Project: CVE-2021-4116
Buggy source:
<?php

return [
	'appVersion' => '6.3.5',
	'patchVersion' => '2021.12.14',
	'lib_roundcube' => '0.2.3',
];


Fixed version (ground truth):
<?php

return [
	'appVersion' => '6.3.6',
	'patchVersion' => '2021.12.14',
	'lib_roundcube' => '0.2.3',
];
Program: CWE-79
Project: CVE-2021-4175
Buggy source:
<h1 class="attr-header">Mobile Options</h1>

<form action="" method="post" ng-non-bindable>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php if (isset($updated) && $updated == 'done') : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Settings updated'); ?>
        <?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
    <?php endif; ?>

    <div class="form-group">
        <label><input type="checkbox" value="on" name="notifications" <?php isset($mb_options['notifications']) && ($mb_options['notifications'] == true) ? print 'checked="checked"' : ''?> /> Enable notifications</label><br/>
    </div>

    <div class="form-group">
        <label>FCM Key</label>
        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />
    </div>

    <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />

</form>


Fixed version (ground truth):
<h1 class="attr-header">Mobile Options</h1>

<form action="" method="post" ng-non-bindable>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php if (isset($updated) && $updated == 'done') : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Settings updated'); ?>
        <?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
    <?php endif; ?>

    <div class="form-group">
        <label><input type="checkbox" value="on" name="notifications" <?php isset($mb_options['notifications']) && ($mb_options['notifications'] == true) ? print 'checked="checked"' : ''?> /> Enable notifications</label><br/>
    </div>

    <div class="form-group">
        <label>FCM Key</label>
        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />
    </div>

    <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />

</form>
Program: CWE-79
Project: CVE-2021-4231
Buggy source:
/**
 * @license
 * Copyright Google LLC All Rights Reserved.
 *
 * Use of this source code is governed by an MIT-style license that can be
 * found in the LICENSE file at https://angular.io/license
 */

import {escapeCommentText} from '@angular/core/src/util/dom';

describe('comment node text escaping', () => {
  describe('escapeCommentText', () => {
    it('should not change anything on basic text', () => {
      expect(escapeCommentText('text')).toEqual('text');
    });

    it('should escape end marker', () => {
      expect(escapeCommentText('before-->after')).toEqual('before-\u200b-\u200b>after');
    });

    it('should escape multiple markers', () => {
      expect(escapeCommentText('before-->inline-->after'))
          .toEqual('before-\u200b-\u200b>inline-\u200b-\u200b>after');
    });
  });
});


Fixed version (ground truth):
/**
 * @license
 * Copyright Google LLC All Rights Reserved.
 *
 * Use of this source code is governed by an MIT-style license that can be
 * found in the LICENSE file at https://angular.io/license
 */

import {escapeCommentText} from '@angular/core/src/util/dom';

describe('comment node text escaping', () => {
  describe('escapeCommentText', () => {
    it('should not change anything on basic text', () => {
      expect(escapeCommentText('text')).toEqual('text');
    });

    it('should escape "<" or ">"', () => {
      expect(escapeCommentText('<!--')).toEqual('\u200b<\u200b!--');
      expect(escapeCommentText('<!--<!--')).toEqual('\u200b<\u200b!--\u200b<\u200b!--');
      expect(escapeCommentText('>')).toEqual('\u200b>\u200b');
      expect(escapeCommentText('>-->')).toEqual('\u200b>\u200b--\u200b>\u200b');
    });

    it('should escape end marker', () => {
      expect(escapeCommentText('before-->after')).toEqual('before--\u200b>\u200bafter');
    });

    it('should escape multiple markers', () => {
      expect(escapeCommentText('before-->inline-->after'))
          .toEqual('before--\u200b>\u200binline--\u200b>\u200bafter');
    });

    it('should caver the spec', () => {
      // https://html.spec.whatwg.org/multipage/syntax.html#comments
      expect(escapeCommentText('>')).toEqual('\u200b>\u200b');
      expect(escapeCommentText('->')).toEqual('-\u200b>\u200b');
      expect(escapeCommentText('<!--')).toEqual('\u200b<\u200b!--');
      expect(escapeCommentText('-->')).toEqual('--\u200b>\u200b');
      expect(escapeCommentText('--!>')).toEqual('--!\u200b>\u200b');
      expect(escapeCommentText('<!-')).toEqual('\u200b<\u200b!-');

      // Things which are OK
      expect(escapeCommentText('.>')).toEqual('.>');
      expect(escapeCommentText('.->')).toEqual('.->');
      expect(escapeCommentText('<!-.')).toEqual('<!-.');
    });
  });
});
Program: CWE-79
Project: CVE-2021-44662
Buggy source:
None

Fixed version (ground truth):
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
Program: CWE-79
Project: CVE-2021-44896
Buggy source:
None

Fixed version (ground truth):
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
Program: CWE-79
Project: CVE-2022-0087
Buggy source:
None

Fixed version (ground truth):
---
'@keystone-6/auth': patch
---

When redirecting to the homepage,  the `from` query parameter unnecessarily displayed `=/`.
This patch fixes that so it is only provided as a query parameter when needed.
Program: CWE-79
Project: CVE-2022-0253
Buggy source:
<h1><?php echo htmlspecialchars($item->name)?></h1>

<?php if (isset($errors)) : ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
<?php endif; ?>

<?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Updated'); ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
<?php endif; ?>

<script>
    var conditionsWebhook = <?php echo json_encode($item->conditions_array,JSON_HEX_APOS)?>;
</script>

<form action="" method="post" enctype="multipart/form-data" ng-controller="WebhooksCtrl as webhooksctl" ng-submit="webhooksctl.updateContinuous()" ng-init='webhooksctl.setConditions();'>

	<?php include(erLhcoreClassDesign::designtpl('lhwebhooks/form.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <div class="btn-group" role="group" aria-label="...">
        <input type="submit" class="btn btn-secondary" name="Update_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
        <input type="submit" class="btn btn-secondary" name="Save_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save & Exit');?>"/>
        <input type="submit" class="btn btn-secondary" name="Cancel_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
	</div>
	
</form>


Fixed version (ground truth):
<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>

<?php if (isset($errors)) : ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
<?php endif; ?>

<?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Updated'); ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
<?php endif; ?>

<script>
    var conditionsWebhook = <?php echo json_encode($item->conditions_array,JSON_HEX_APOS)?>;
</script>

<form action="" method="post" enctype="multipart/form-data" ng-controller="WebhooksCtrl as webhooksctl" ng-submit="webhooksctl.updateContinuous()" ng-init='webhooksctl.setConditions();'>

	<?php include(erLhcoreClassDesign::designtpl('lhwebhooks/form.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <div class="btn-group" role="group" aria-label="...">
        <input type="submit" class="btn btn-secondary" name="Update_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
        <input type="submit" class="btn btn-secondary" name="Save_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save & Exit');?>"/>
        <input type="submit" class="btn btn-secondary" name="Cancel_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
	</div>
	
</form>
Program: CWE-79
Project: CVE-2022-0374
Buggy source:
<div class="row">
    <div class="col-10"><h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Edit theme');?> - <?php echo htmlspecialchars($form->name)?></h1></div>
    <?php /*?><div class="col-2">
        <a class="btn btn-secondary" href="?export=1"><i class="material-icons mr-0">file_download</i></a>
    </div>*/ ?>
</div>

<form action="<?php echo erLhcoreClassDesign::baseurl('theme/adminthemeedit')?>/<?php echo $form->id?>" method="post" autocomplete="off" enctype="multipart/form-data">

    <?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Updated'); ?>
			<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
	<?php endif; ?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhtheme/admin/form.tpl.php'));?>

	<div class="btn-group" role="group" aria-label="...">
      <input type="submit" class="btn btn-secondary" name="SaveAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
      <input type="submit" class="btn btn-secondary" name="UpdateAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
      <input type="submit" class="btn btn-secondary" name="CancelAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
    </div>

</form>

Fixed version (ground truth):
<div class="row" ng-non-bindable>
    <div class="col-10"><h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Edit theme');?> - <?php echo htmlspecialchars($form->name)?></h1></div>
</div>

<form action="<?php echo erLhcoreClassDesign::baseurl('theme/adminthemeedit')?>/<?php echo $form->id?>" method="post" autocomplete="off" enctype="multipart/form-data">

    <?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Updated'); ?>
			<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
	<?php endif; ?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhtheme/admin/form.tpl.php'));?>

	<div class="btn-group" role="group" aria-label="...">
      <input type="submit" class="btn btn-secondary" name="SaveAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
      <input type="submit" class="btn btn-secondary" name="UpdateAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
      <input type="submit" class="btn btn-secondary" name="CancelAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
    </div>

</form>
Program: CWE-79
Project: CVE-2022-0375
Buggy source:
<div class="row">
    <div class="col-10"><h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Edit theme');?> - <?php echo htmlspecialchars($form->name)?></h1></div>
    <?php /*?><div class="col-2">
        <a class="btn btn-secondary" href="?export=1"><i class="material-icons mr-0">file_download</i></a>
    </div>*/ ?>
</div>

<form action="<?php echo erLhcoreClassDesign::baseurl('theme/adminthemeedit')?>/<?php echo $form->id?>" method="post" autocomplete="off" enctype="multipart/form-data">

    <?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Updated'); ?>
			<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
	<?php endif; ?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhtheme/admin/form.tpl.php'));?>

	<div class="btn-group" role="group" aria-label="...">
      <input type="submit" class="btn btn-secondary" name="SaveAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
      <input type="submit" class="btn btn-secondary" name="UpdateAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
      <input type="submit" class="btn btn-secondary" name="CancelAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
    </div>

</form>

Fixed version (ground truth):
<div class="row" ng-non-bindable>
    <div class="col-10"><h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Edit theme');?> - <?php echo htmlspecialchars($form->name)?></h1></div>
</div>

<form action="<?php echo erLhcoreClassDesign::baseurl('theme/adminthemeedit')?>/<?php echo $form->id?>" method="post" autocomplete="off" enctype="multipart/form-data">

    <?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Updated'); ?>
			<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
	<?php endif; ?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhtheme/admin/form.tpl.php'));?>

	<div class="btn-group" role="group" aria-label="...">
      <input type="submit" class="btn btn-secondary" name="SaveAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
      <input type="submit" class="btn btn-secondary" name="UpdateAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
      <input type="submit" class="btn btn-secondary" name="CancelAction" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
    </div>

</form>
Program: CWE-79
Project: CVE-2022-0379
Buggy source:
<?php

namespace MicroweberPackages\Checkout\Http\Middleware;

use Closure;

class CheckoutV2
{
    /**
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {

        $checkCart = cart_get_items_count();

        if (!$checkCart) {
            //$shop_page = get_content('single=true&content_type=page&is_shop=1');
            $shop_page = app()->content_repository->getFirstShopPage();

            $redir = site_url();
            if ($shop_page and isset($shop_page['id'])) {
                $link = content_link($shop_page['id']);
                if ($link) {
                    $redir = $link;
                }

            }

            return redirect($redir);
        }

        $requiresRegistration = get_option('shop_require_registration', 'website') == '1';
        if ($requiresRegistration and is_logged() == false) {
            return redirect(route('checkout.login'));
        }

        return $next($request);
    }
}


Fixed version (ground truth):
<?php

namespace MicroweberPackages\Checkout\Http\Middleware;

use Closure;

class CheckoutV2
{
    /**
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $checkCart = cart_get_items_count();

        if (!$checkCart) {
            //$shop_page = get_content('single=true&content_type=page&is_shop=1');
            $shop_page = app()->content_repository->getFirstShopPage();

            $redir = site_url();
            if ($shop_page and isset($shop_page['id'])) {
                $link = content_link($shop_page['id']);
                if ($link) {
                    $redir = $link;
                }

            }

            return redirect($redir);
        }

        $requiresRegistration = get_option('shop_require_registration', 'website') == '1';
        if ($requiresRegistration and is_logged() == false) {
            return redirect(route('checkout.login'));
        }

        return $next($request);
    }
}
Program: CWE-79
Project: CVE-2022-0387
Buggy source:
<h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department limit group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>

<?php if (isset($errors)) : ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
<?php endif; ?>

<?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Updated'); ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
<?php endif; ?>

<form action="" method="post">

	<?php include(erLhcoreClassDesign::designtpl('lhdepartment/formlimitgroup.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <div class="btn-group" role="group" aria-label="...">
         <input type="submit" class="btn btn-secondary" name="Save_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
         <input type="submit" class="btn btn-secondary" name="Update_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
         <input type="submit" class="btn btn-secondary" name="Cancel_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
	</div>
	
</form>


Fixed version (ground truth):
<h1 ng-non-bindable><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department limit group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>

<?php if (isset($errors)) : ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
<?php endif; ?>

<?php if (isset($updated)) : $msg = erTranslationClassLhTranslation::getInstance()->getTranslation('user/account','Updated'); ?>
	<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
<?php endif; ?>

<form action="" method="post">

	<?php include(erLhcoreClassDesign::designtpl('lhdepartment/formlimitgroup.tpl.php'));?>

    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    <div class="btn-group" role="group" aria-label="...">
         <input type="submit" class="btn btn-secondary" name="Save_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
         <input type="submit" class="btn btn-secondary" name="Update_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
         <input type="submit" class="btn btn-secondary" name="Cancel_departament" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/>
	</div>
	
</form>