Vulnerability: Cross site scripting in dolibarr A Cross-site Scripting (XSS) vulnerability exists in the admin/accountant.php file. The fields `town`, `name`, and `Accountant code` can be used to escape double quote protection.
Vulnerability ID: GHSA-8fvr-7945-mg7w
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/dolibarr/dolibarr
Published: 2022-06-14
File: htdocs/user/bank.php
Commit message: Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop
Commit author: Laurent Destailleur

Vulnerable version (before fix):
 	print "</tr>\n";  	// Date of birth 	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) { 		print '<tr>'; 		print '<td>'; 		print $form->editfieldkey("DateOfBirth", 'birth', $object->birth, $object, $user->rights->user->user->creer); 	}  	// Personal email 	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("UserPersonalEmail", 'personal_email', $object->personal_email, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// Personal phone 	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("UserPersonalMobile", 'personal_mobile', $object->personal_mobile, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// Employee Number 	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("RefEmployee", 'ref_employee', $object->ref_employee, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// National registration number 	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("NationalRegistrationNumber", 'national_registration_number', $object->national_registration_number, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);

Fixed version (after fix):
 	print "</tr>\n";  	// Date of birth 	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) { 		print '<tr>'; 		print '<td>'; 		print $form->editfieldkey("DateOfBirth", 'birth', $object->birth, $object, $user->rights->user->user->creer); 	}  	// Personal email 	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("UserPersonalEmail", 'personal_email', $object->personal_email, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// Personal phone 	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("UserPersonalMobile", 'personal_mobile', $object->personal_mobile, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// Employee Number 	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("RefEmployee", 'ref_employee', $object->ref_employee, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write); 	}  	// National registration number 	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) { 		print '<tr class="nowrap">'; 		print '<td>'; 		print $form->editfieldkey("NationalRegistrationNumber", 'national_registration_number', $object->national_registration_number, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);

Patch:
patch: @@ -446,7 +446,7 @@
 	print "</tr>\n";
 
 	// Date of birth
-	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) {
+	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) {
 		print '<tr>';
 		print '<td>';
 		print $form->editfieldkey("DateOfBirth", 'birth', $object->birth, $object, $user->rights->user->user->creer);
@@ -457,7 +457,7 @@
 	}
 
 	// Personal email
-	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) {
+	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) {
 		print '<tr class="nowrap">';
 		print '<td>';
 		print $form->editfieldkey("UserPersonalEmail", 'personal_email', $object->personal_email, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);
@@ -468,7 +468,7 @@
 	}
 
 	// Personal phone
-	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) {
+	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) {
 		print '<tr class="nowrap">';
 		print '<td>';
 		print $form->editfieldkey("UserPersonalMobile", 'personal_mobile', $object->personal_mobile, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);
@@ -533,7 +533,7 @@
 	}
 
 	// Employee Number
-	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) {
+	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) {
 		print '<tr class="nowrap">';
 		print '<td>';
 		print $form->editfieldkey("RefEmployee", 'ref_employee', $object->ref_employee, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);
@@ -544,7 +544,7 @@
 	}
 
 	// National registration number
-	if ($user->rights->hrm->read_personal_information->read || $user->rights->hrm->write_personal_information->write) {
+	if ($user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write')) {
 		print '<tr class="nowrap">';
 		print '<td>';
 		print $form->editfieldkey("NationalRegistrationNumber", 'national_registration_number', $object->national_registration_number, $object, $user->rights->user->user->creer || $user->rights->hrm->write_personal_information->write);
path: htdocs/user/bank.php