Program: CWE-79
Project: CVE-2016-9454
Buggy source:
{*<!--

+---------------------------------------------------------------------------+
| Revive Adserver                                                           |
| http://www.revive-adserver.com                                            |
|                                                                           |
| Copyright: See the COPYRIGHT.txt file.                                    |
| License: GPLv2 or later, see the LICENSE.txt file.                        |
+---------------------------------------------------------------------------+

-->*}
{if $status == 'linked'}
  {assign var="checkboxPrefix" value="l"}
{else}
  {assign var="checkboxPrefix" value="a"}
{/if}


<!--rows-{$status}-start-->
{if !empty($topPager->links)}
<span id="page-{$status}" class="hide">{$page}</span>
<div class="tableWrapper topPagerContainer clearfix">
  <div class="pager topPager">
    {$topPager->links}
  </div>
</div>
{/if}
<table id="zones-{$status}" class="zones new-table tableWrapper">
  <tbody>
    <tr class="header hide">
      <th class="name"><label><input type="checkbox" id="{$status}-select-all" class="checkbox select-all" /> {t str=SelectUnselectAll}</label></th>
      <th class="link"></th>
      {if !empty($showStats)}
          <th class="ctr">{t str=FinanceCTR}</th>
          <th class="cr">{t str=FinanceCR}</th>
          <th class="ecpm last">{t str=FinanceCPM}</th>
      {/if}
    </tr>
  </tbody>

  {if !empty($topPager->links)}
  <tbody id="select-all-container-{$status}" class="hide">
    <tr class="header">
      <th colspan="{$colspan}">
        <div id="zones-{$status}-select-all" class="selectAllInAccount hide">
          All <em>{$zonescounts.showing}</em> zones on this page selected. <a href="#">Select all <em>{$zonescounts.matching}</em> matching zones from this account.</a>
        </div>
        <div id="zones-{$status}-all-selected" class="selectAllInAccount hide">
          All <em>{$zonescounts.matching}</em> matching zones from this account selected. <a href="#">Clear selection</a></a>
        </div>
      </th>
    </tr>
  </tbody>
  {/if}

  <tbody id="zones-{$status}-rows">
    {foreach from=$websites key=websiteid item=website}
    <tr class="website">
      <td class="name" title="{$website.name|escape}">
        <label style="white-space: nowrap">
            <input id="{$checkboxPrefix}w{$websiteid}"
                   name="w{$websiteid}" type="checkbox" class="checkbox parent" />{boldSearchPhrase text=$website.name search=$text}
        </label>
      </td>
      <td class="link">
          <a title="{t str=EditWebsite} {$website.name}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
      </td>
      {if !empty($showStats)}
          <td></td>
          <td></td>
          <td></td>
      {/if}
    </tr>

      {foreach from=$website.zones key=zoneid item=zone}
      <tr class="zone {if $aZonesIdHash[$zoneid]} just-linked{/if}">
        <td class="name" title="{$zone.name|escape}">
        <label>
            <input id="{$checkboxPrefix}w{$websiteid}_z{$zoneid}"
                   name="z{$zoneid}" type="checkbox" class="checkbox" />
            {boldSearchPhrase text=$zone.name search=$text}
        </label>
        </td>
        <td class="link">
            <a title="{t str=EditZone} {$website.name}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>
        </td>
        {if !empty($showStats)}
            {assign var="ctr" value="`$zone.ctr*100`"}
            {assign var="cr" value="`$zone.cr*100`"}
            <td {if $zone.campaign_stats}class="estim"{/if}>{$ctr|string_format:"%.3f"}%</td>
            <td {if $zone.campaign_stats}class="estim"{/if}>{$cr|string_format:"%.3f"}%</td>
            <td {if $zone.campaign_stats}class="estim"{/if}>${$zone.ecpm|string_format:"%.2f"}</td>
        {/if}
      </tr>
      {/foreach}

    {foreachelse}
    <tr class="empty">
      <td colspan="{$colspan}">
        {t str=NoWebsitesAndZones}
        {if $text}
          {t str=NoWebsitesAndZonesText values=$text|escape}
        {/if}

        {if $checkboxPrefix == 'a'}
        {t str=ToLink}
        {else}
        {t str=ToUnlink}
        {/if}
      </td>
    </tr>
    {/foreach}
  </tbody>
  {if !empty($pager->links)}
  <tfoot class="tableFooter">
      <tr>
      <td  colspan="{$colspan}">
            <div class="pager">
              <span class="summary">{$pager->summary}</span>
              <span class="controls">{$pager->links}</span>
            </div>
      </td>
      </tr>
  </tfoot>
  {/if}

</table>
<!--rows-{$status}-end-->

<!--status-{$status}-start-->
  {if $status == 'linked'}
  {t str=Linked}:
  {else}
  {t str=Available}:
  {/if}
  <span class="status-value">{$zonescounts.all}</span><br />

  {t str=Showing}: <span class="status-value">{$zonescounts.showing}</span>
<!--status-{$status}-end-->


Fixed version (ground truth):
{*<!--

+---------------------------------------------------------------------------+
| Revive Adserver                                                           |
| http://www.revive-adserver.com                                            |
|                                                                           |
| Copyright: See the COPYRIGHT.txt file.                                    |
| License: GPLv2 or later, see the LICENSE.txt file.                        |
+---------------------------------------------------------------------------+

-->*}
{if $status == 'linked'}
  {assign var="checkboxPrefix" value="l"}
{else}
  {assign var="checkboxPrefix" value="a"}
{/if}


<!--rows-{$status}-start-->
{if !empty($topPager->links)}
<span id="page-{$status}" class="hide">{$page}</span>
<div class="tableWrapper topPagerContainer clearfix">
  <div class="pager topPager">
    {$topPager->links}
  </div>
</div>
{/if}
<table id="zones-{$status}" class="zones new-table tableWrapper">
  <tbody>
    <tr class="header hide">
      <th class="name"><label><input type="checkbox" id="{$status}-select-all" class="checkbox select-all" /> {t str=SelectUnselectAll}</label></th>
      <th class="link"></th>
      {if !empty($showStats)}
          <th class="ctr">{t str=FinanceCTR}</th>
          <th class="cr">{t str=FinanceCR}</th>
          <th class="ecpm last">{t str=FinanceCPM}</th>
      {/if}
    </tr>
  </tbody>

  {if !empty($topPager->links)}
  <tbody id="select-all-container-{$status}" class="hide">
    <tr class="header">
      <th colspan="{$colspan}">
        <div id="zones-{$status}-select-all" class="selectAllInAccount hide">
          All <em>{$zonescounts.showing}</em> zones on this page selected. <a href="#">Select all <em>{$zonescounts.matching}</em> matching zones from this account.</a>
        </div>
        <div id="zones-{$status}-all-selected" class="selectAllInAccount hide">
          All <em>{$zonescounts.matching}</em> matching zones from this account selected. <a href="#">Clear selection</a></a>
        </div>
      </th>
    </tr>
  </tbody>
  {/if}

  <tbody id="zones-{$status}-rows">
    {foreach from=$websites key=websiteid item=website}
    <tr class="website">
      <td class="name" title="{$website.name|escape}">
        <label style="white-space: nowrap">
            <input id="{$checkboxPrefix}w{$websiteid}"
                   name="w{$websiteid}" type="checkbox" class="checkbox parent" />{boldSearchPhrase text=$website.name search=$text}
        </label>
      </td>
      <td class="link">
          <a title="{t str=EditWebsite} {$website.name|escape}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
      </td>
      {if !empty($showStats)}
          <td></td>
          <td></td>
          <td></td>
      {/if}
    </tr>

      {foreach from=$website.zones key=zoneid item=zone}
      <tr class="zone {if $aZonesIdHash[$zoneid]} just-linked{/if}">
        <td class="name" title="{$zone.name|escape}">
        <label>
            <input id="{$checkboxPrefix}w{$websiteid}_z{$zoneid}"
                   name="z{$zoneid}" type="checkbox" class="checkbox" />
            {boldSearchPhrase text=$zone.name search=$text}
        </label>
        </td>
        <td class="link">
            <a title="{t str=EditZone} {$website.name|escape}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>
        </td>
        {if !empty($showStats)}
            {assign var="ctr" value="`$zone.ctr*100`"}
            {assign var="cr" value="`$zone.cr*100`"}
            <td {if $zone.campaign_stats}class="estim"{/if}>{$ctr|string_format:"%.3f"}%</td>
            <td {if $zone.campaign_stats}class="estim"{/if}>{$cr|string_format:"%.3f"}%</td>
            <td {if $zone.campaign_stats}class="estim"{/if}>${$zone.ecpm|string_format:"%.2f"}</td>
        {/if}
      </tr>
      {/foreach}

    {foreachelse}
    <tr class="empty">
      <td colspan="{$colspan}">
        {t str=NoWebsitesAndZones}
        {if $text}
          {t str=NoWebsitesAndZonesText values=$text|escape}
        {/if}

        {if $checkboxPrefix == 'a'}
        {t str=ToLink}
        {else}
        {t str=ToUnlink}
        {/if}
      </td>
    </tr>
    {/foreach}
  </tbody>
  {if !empty($pager->links)}
  <tfoot class="tableFooter">
      <tr>
      <td  colspan="{$colspan}">
            <div class="pager">
              <span class="summary">{$pager->summary}</span>
              <span class="controls">{$pager->links}</span>
            </div>
      </td>
      </tr>
  </tfoot>
  {/if}

</table>
<!--rows-{$status}-end-->

<!--status-{$status}-start-->
  {if $status == 'linked'}
  {t str=Linked}:
  {else}
  {t str=Available}:
  {/if}
  <span class="status-value">{$zonescounts.all}</span><br />

  {t str=Showing}: <span class="status-value">{$zonescounts.showing}</span>
<!--status-{$status}-end-->