Program: CWE-352
Project: CVE-2021-3963
Buggy source:
{% extends 'base.html.twig' %}
{% import "macros/widgets.html.twig" as widgets %}
{% import "project/actions.html.twig" as actions %}

{% block page_title %}{{ 'admin_project.title'|trans }}{% endblock %}
{% block page_actions %}{{ actions.project(project, 'project_details') }}{% endblock %}

{% block main %}
    {% set can_edit = is_granted('edit', project) %}

    {% embed '@AdminLTE/Widgets/box-widget.html.twig' %}
        {% import "macros/widgets.html.twig" as widgets %}
        {% import "customer/actions.html.twig" as customerActions %}
        {% block box_attributes %}id="project_details_box"{% endblock %}
        {% block box_tools %}
            {% if can_edit %}
                <a class="modal-ajax-form open-edit btn btn-default btn-sm" data-href="{{ path('admin_project_edit', {'id': project.id}) }}" data-toggle="tooltip" data-placement="top" title="{{ 'action.edit'|trans }}"><i class="{{ 'edit'|icon }}"></i></a>
            {% endif %}
        {% endblock %}
        {% block box_title %}
            {{ widgets.label_name(project.name, project.color) }}
        {% endblock %}
        {% block box_body_class %}no-padding{% endblock %}
        {% block box_body %}
            {% if project.comment is not empty %}
                <div class="comment">
                    {{ project.comment|comment2html(true) }}
                </div>
            {% endif %}
            <table class="table table-hover dataTable">
                {% if not project.visible %}
                    <tr class="{{ widgets.class_project_row(project, now) }}">
                        <th>{{ 'label.visible'|trans }}</th>
                        <td colspan="3">
                            {{ widgets.label_boolean(project.visible) }}
                        </td>
                    </tr>
                {% endif %}
                <tr {{ widgets.customer_row_attr(project.customer, now) }}>
                    <th>{{ 'label.customer'|trans }}</th>
                    <td>
                        {{ widgets.label_customer(project.customer) }}
                    </td>
                    <td class="w-min">
                        {{ widgets.badge_team_access(project.customer.teams) }}
                    </td>
                    <td class="actions">
                        {{ customerActions.customer(project.customer, 'custom') }}
                    </td>
                </tr>
                {% if is_granted('details', project) %}
                    {% if project.orderNumber is not empty %}
                    <tr>
                        <th>{{ 'label.orderNumber'|trans }}</th>
                        <td colspan="3">
                            {{ project.orderNumber }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.orderDate is not empty %}
                    <tr>
                        <th>{{ 'label.orderDate'|trans }}</th>
                        <td colspan="3">
                            {{ project.orderDate|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.start is not empty %}
                    <tr>
                        <th>{{ 'label.project_start'|trans }}</th>
                        <td colspan="3">
                            {{ project.start|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.end is not empty %}
                    <tr>
                        <th>{{ 'label.project_end'|trans }}</th>
                        <td colspan="3">
                            {{ project.end|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                {% endif %}
                {% if is_granted('budget', project) %}
                    {% if project.hasBudget() %}
                    <tr>
                        <th>
                            {{ 'label.budget'|trans }}
                            {% if project.isMonthlyBudget() %}
                                ({{ 'label.budgetType_month'|trans }})
                            {% endif %}
                        </th>
                        <td colspan="3">
                            {{ project.getBudget()|money(project.customer.currency) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.hasTimeBudget() %}
                    <tr>
                        <th>
                            {{ 'label.timeBudget'|trans }}
                            {% if project.isMonthlyBudget() %}
                                ({{ 'label.budgetType_month'|trans }})
                            {% endif %}
                        </th>
                        <td colspan="3">
                            {{ project.getTimeBudget()|duration }}
                        </td>
                    </tr>
                    {% endif %}
                {% endif %}
                {% for metaField in project.visibleMetaFields|sort((a, b) => a.order <=> b.order) %}
                    <tr>
                        <th>{{ metaField.label|trans }}</th>
                        <td colspan="3">{{ widgets.form_type_value(metaField.type, metaField.value, project) }}</td>
                    </tr>
                {% endfor %}
            </table>
        {% endblock %}
    {% endembed %}

    {{ render(controller('App\\Controller\\ProjectController::activitiesAction', {'project': project.id, 'page': 1})) }}

    {% if stats is not null %}
        {{ include('embeds/budgets.html.twig', {'entity': project, 'stats': stats, 'currency': project.customer.currency}) }}
    {% endif %}

    {% if can_edit %}
        {{ include('embeds/rates-table.html.twig', {'id': 'project_rates_box', 'entity': project, 'create_url': path('admin_project_rate_add', {'id': project.id}), 'delete_route': 'delete_project_rate', 'currency': project.customer.currency}) }}
    {% endif %}

    {% if teams is not null%}
        {% set options = {'teams': teams, 'team': team} %}
        {% if is_granted('permissions', project) %}
            {% set options = options|merge({'route_create': path('project_team_create', {'id': project.id}), 'route_edit': path('admin_project_permissions', {'id': project.id})}) %}
        {% endif %}
        {% if project.customer.teams|length > 0 %}
            {% set options = options|merge({'empty_message': 'team.project_visibility_inherited'}) %}
        {% endif %}
        {{ include('embeds/teams.html.twig', options) }}
    {% endif %}

    {% if comments is not null %}
        {% set options = {'form': commentForm, 'comments': comments} %}
        {% if can_edit %}
            {% set options = options|merge({'route_pin': 'project_comment_pin', 'route_delete': 'project_comment_delete'}) %}
        {% endif %}
        {{ include('embeds/comments.html.twig', options) }}
    {% endif %}

{% endblock %}

{% block javascripts %}
    {{ parent() }}
    <script type="text/javascript">
        document.addEventListener('kimai.initialized', function() {
            KimaiReloadPageWidget.create('kimai.customerTeamUpdate kimai.projectTeamUpdate kimai.activityTeamUpdate kimai.projectUpdate kimai.teamUpdate kimai.customerUpdate kimai.rateUpdate');
        });
    </script>
{% endblock %}


Fixed version (ground truth):
{% extends 'base.html.twig' %}
{% import "macros/widgets.html.twig" as widgets %}
{% import "project/actions.html.twig" as actions %}

{% block page_title %}{{ 'admin_project.title'|trans }}{% endblock %}
{% block page_actions %}{{ actions.project(project, 'project_details') }}{% endblock %}

{% block main %}
    {% set can_edit = is_granted('edit', project) %}

    {% embed '@AdminLTE/Widgets/box-widget.html.twig' %}
        {% import "macros/widgets.html.twig" as widgets %}
        {% import "customer/actions.html.twig" as customerActions %}
        {% block box_attributes %}id="project_details_box"{% endblock %}
        {% block box_tools %}
            {% if can_edit %}
                <a class="modal-ajax-form open-edit btn btn-default btn-sm" data-href="{{ path('admin_project_edit', {'id': project.id}) }}" data-toggle="tooltip" data-placement="top" title="{{ 'action.edit'|trans }}"><i class="{{ 'edit'|icon }}"></i></a>
            {% endif %}
        {% endblock %}
        {% block box_title %}
            {{ widgets.label_name(project.name, project.color) }}
        {% endblock %}
        {% block box_body_class %}no-padding{% endblock %}
        {% block box_body %}
            {% if project.comment is not empty %}
                <div class="comment">
                    {{ project.comment|comment2html(true) }}
                </div>
            {% endif %}
            <table class="table table-hover dataTable">
                {% if not project.visible %}
                    <tr class="{{ widgets.class_project_row(project, now) }}">
                        <th>{{ 'label.visible'|trans }}</th>
                        <td colspan="3">
                            {{ widgets.label_boolean(project.visible) }}
                        </td>
                    </tr>
                {% endif %}
                <tr {{ widgets.customer_row_attr(project.customer, now) }}>
                    <th>{{ 'label.customer'|trans }}</th>
                    <td>
                        {{ widgets.label_customer(project.customer) }}
                    </td>
                    <td class="w-min">
                        {{ widgets.badge_team_access(project.customer.teams) }}
                    </td>
                    <td class="actions">
                        {{ customerActions.customer(project.customer, 'custom') }}
                    </td>
                </tr>
                {% if is_granted('details', project) %}
                    {% if project.orderNumber is not empty %}
                    <tr>
                        <th>{{ 'label.orderNumber'|trans }}</th>
                        <td colspan="3">
                            {{ project.orderNumber }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.orderDate is not empty %}
                    <tr>
                        <th>{{ 'label.orderDate'|trans }}</th>
                        <td colspan="3">
                            {{ project.orderDate|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.start is not empty %}
                    <tr>
                        <th>{{ 'label.project_start'|trans }}</th>
                        <td colspan="3">
                            {{ project.start|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.end is not empty %}
                    <tr>
                        <th>{{ 'label.project_end'|trans }}</th>
                        <td colspan="3">
                            {{ project.end|date_full(true) }}
                        </td>
                    </tr>
                    {% endif %}
                {% endif %}
                {% if is_granted('budget', project) %}
                    {% if project.hasBudget() %}
                    <tr>
                        <th>
                            {{ 'label.budget'|trans }}
                            {% if project.isMonthlyBudget() %}
                                ({{ 'label.budgetType_month'|trans }})
                            {% endif %}
                        </th>
                        <td colspan="3">
                            {{ project.getBudget()|money(project.customer.currency) }}
                        </td>
                    </tr>
                    {% endif %}
                    {% if project.hasTimeBudget() %}
                    <tr>
                        <th>
                            {{ 'label.timeBudget'|trans }}
                            {% if project.isMonthlyBudget() %}
                                ({{ 'label.budgetType_month'|trans }})
                            {% endif %}
                        </th>
                        <td colspan="3">
                            {{ project.getTimeBudget()|duration }}
                        </td>
                    </tr>
                    {% endif %}
                {% endif %}
                {% for metaField in project.visibleMetaFields|sort((a, b) => a.order <=> b.order) %}
                    <tr>
                        <th>{{ metaField.label|trans }}</th>
                        <td colspan="3">{{ widgets.form_type_value(metaField.type, metaField.value, project) }}</td>
                    </tr>
                {% endfor %}
            </table>
        {% endblock %}
    {% endembed %}

    {{ render(controller('App\\Controller\\ProjectController::activitiesAction', {'project': project.id, 'page': 1})) }}

    {% if stats is not null %}
        {{ include('embeds/budgets.html.twig', {'entity': project, 'stats': stats, 'currency': project.customer.currency}) }}
    {% endif %}

    {% if can_edit %}
        {{ include('embeds/rates-table.html.twig', {'id': 'project_rates_box', 'entity': project, 'create_url': path('admin_project_rate_add', {'id': project.id}), 'delete_route': 'delete_project_rate', 'currency': project.customer.currency}) }}
    {% endif %}

    {% if teams is not null%}
        {% set options = {'teams': teams, 'team': team} %}
        {% if is_granted('permissions', project) %}
            {% set options = options|merge({'route_create': path('project_team_create', {'id': project.id}), 'route_edit': path('admin_project_permissions', {'id': project.id})}) %}
        {% endif %}
        {% if project.customer.teams|length > 0 %}
            {% set options = options|merge({'empty_message': 'team.project_visibility_inherited'}) %}
        {% endif %}
        {{ include('embeds/teams.html.twig', options) }}
    {% endif %}

    {% if comments is not null %}
        {% set options = {'form': commentForm, 'comments': comments} %}
        {% if can_edit %}
            {% set options = options|merge({'route_pin': 'project_comment_pin', 'route_delete': 'project_comment_delete', 'csrf_delete': 'project.delete_comment', 'csrf_pin': 'project.pin_comment'}) %}
        {% endif %}
        {{ include('embeds/comments.html.twig', options) }}
    {% endif %}

{% endblock %}

{% block javascripts %}
    {{ parent() }}
    <script type="text/javascript">
        document.addEventListener('kimai.initialized', function() {
            KimaiReloadPageWidget.create('kimai.customerTeamUpdate kimai.projectTeamUpdate kimai.activityTeamUpdate kimai.projectUpdate kimai.teamUpdate kimai.customerUpdate kimai.rateUpdate');
        });
    </script>
{% endblock %}