rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
Vulnerability ID: CVE-2019-16966
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/FreePBX/contactmanager
Published: 2019-10-21
File: Contactmanager.class.php
Commit message: fix int options
Commit author: Franck Danard

Vulnerable version (before fix):
 public function myShowPage() { 			break; 			case "showgroup": 			case "addgroup": 				if ($action == "showgroup" && !empty((int) $_REQUEST['group'])) { 					$group = $this->getGroupByID((int) $_REQUEST['group']); 					$entries = $this->getEntriesByGroupID((int) $_REQUEST['group']); 				} public function myShowPage() { 			break; 			case "showentry": 			case "addentry": 				if (!empty((int) $_REQUEST['group'])) { 					$group = $this->getGroupByID((int) $_REQUEST['group']);  					if ($action == "showentry" && !empty($_REQUEST['entry'])) {

Fixed version (after fix):
 public function myShowPage() { 			break; 			case "showgroup": 			case "addgroup": 				if ($action == "showgroup" && !empty($_REQUEST['group'])) { 					$group = $this->getGroupByID((int) $_REQUEST['group']); 					$entries = $this->getEntriesByGroupID((int) $_REQUEST['group']); 				} public function myShowPage() { 			break; 			case "showentry": 			case "addentry": 				if (!empty($_REQUEST['group'])) { 					$group = $this->getGroupByID((int) $_REQUEST['group']);  					if ($action == "showentry" && !empty($_REQUEST['entry'])) {

Patch:
patch: @@ -975,7 +975,7 @@ public function myShowPage() {
 			break;
 			case "showgroup":
 			case "addgroup":
-				if ($action == "showgroup" && !empty((int) $_REQUEST['group'])) {
+				if ($action == "showgroup" && !empty($_REQUEST['group'])) {
 					$group = $this->getGroupByID((int) $_REQUEST['group']);
 					$entries = $this->getEntriesByGroupID((int) $_REQUEST['group']);
 				}
@@ -984,7 +984,7 @@ public function myShowPage() {
 			break;
 			case "showentry":
 			case "addentry":
-				if (!empty((int) $_REQUEST['group'])) {
+				if (!empty($_REQUEST['group'])) {
 					$group = $this->getGroupByID((int) $_REQUEST['group']);
 
 					if ($action == "showentry" && !empty($_REQUEST['entry'])) {
path: Contactmanager.class.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16969
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/fifo_list/fifo_interactive.php
Commit message: Update fifo_interactive.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	Contributor(s): 	Mark J Crane <markjcrane@fusionpbx.com> */ include "root.php"; require_once "resources/require.php"; require_once "resources/check_auth.php"; if (permission_exists('active_queue_view')) { 	//access granted } else { 	echo "access denied"; 	exit; }  //add multi-lingual support 	$language = new text; 	$text = $language->get();  //get the fifo_name from http and set it to a php variable 	$fifo_name = trim($_REQUEST["c"]);  //if not the user is not a member of the superadmin then restrict to viewing their own domain 	if (!if_group("superadmin")) { function send_cmd(url) { echo "<br><br>";  require_once "resources/footer.php"; ?>

Fixed version (after fix):
 	Contributor(s): 	Mark J Crane <markjcrane@fusionpbx.com> */  //includes 	include "root.php"; 	require_once "resources/require.php"; 	require_once "resources/check_auth.php";  //check permissions 	if (permission_exists('active_queue_view')) { 		//access granted 	} 	else { 		echo "access denied"; 		exit; 	}  //add multi-lingual support 	$language = new text; 	$text = $language->get();  //get the fifo_name from http and set it to a php variable 	$fifo_name = preg_replace('#[^a-zA-Z0-9\_\@\-./]#', '', $_REQUEST["c"]);  //if not the user is not a member of the superadmin then restrict to viewing their own domain 	if (!if_group("superadmin")) { function send_cmd(url) { echo "<br><br>";  require_once "resources/footer.php";  ?>

Patch:
patch: @@ -23,23 +23,27 @@
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
-include "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (permission_exists('active_queue_view')) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
+
+//includes
+	include "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (permission_exists('active_queue_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
 	$text = $language->get();
 
 //get the fifo_name from http and set it to a php variable
-	$fifo_name = trim($_REQUEST["c"]);
+	$fifo_name = preg_replace('#[^a-zA-Z0-9\_\@\-./]#', '', $_REQUEST["c"]);
 
 //if not the user is not a member of the superadmin then restrict to viewing their own domain
 	if (!if_group("superadmin")) {
@@ -139,4 +143,5 @@ function send_cmd(url) {
 echo "<br><br>";
 
 require_once "resources/footer.php";
+
 ?>
path: app/fifo_list/fifo_interactive.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16970
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/sip_status/sip_status.php
Commit message: Update sip_status.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	$row_style["0"] = "row_style0"; 	$row_style["1"] = "row_style1";  if ($_GET['a'] == "download") { 	if ($_GET['t'] == "cdrcsv") { 		$tmp = $_SESSION['switch']['log']['dir'].'/cdr-csv/'; 		$filename = 'Master.csv'; 	} 	if ($_GET['t'] == "backup") { 		$tmp = $backup_dir.'/'; 		$filename = 'backup.tgz'; 		if (!is_dir($backup_dir.'/')) { 			exec("mkdir ".$backup_dir."/"); 		} 		$parent_dir = realpath($_SESSION['switch']['base']['dir']."/.."); 		chdir($parent_dir); 		shell_exec('tar cvzf freeswitch '.$backup_dir.'/backup.tgz'); 	} 	session_cache_limiter('public'); 	$fd = fopen($tmp.$filename, "rb"); 	header("Content-Type: binary/octet-stream"); 	header("Content-Length: " . filesize($tmp.$filename)); 	header('Content-Disposition: attachment; filename="'.$filename.'"'); 	fpassthru($fd); 	exit; }  //show the content 	require_once "resources/header.php"; 	$document['title'] = $text['title-sip-status'];

Fixed version (after fix):
 	$row_style["0"] = "row_style0"; 	$row_style["1"] = "row_style1";  //show the content 	require_once "resources/header.php"; 	$document['title'] = $text['title-sip-status'];

Patch:
patch: @@ -49,30 +49,6 @@
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
 
-if ($_GET['a'] == "download") {
-	if ($_GET['t'] == "cdrcsv") {
-		$tmp = $_SESSION['switch']['log']['dir'].'/cdr-csv/';
-		$filename = 'Master.csv';
-	}
-	if ($_GET['t'] == "backup") {
-		$tmp = $backup_dir.'/';
-		$filename = 'backup.tgz';
-		if (!is_dir($backup_dir.'/')) {
-			exec("mkdir ".$backup_dir."/");
-		}
-		$parent_dir = realpath($_SESSION['switch']['base']['dir']."/..");
-		chdir($parent_dir);
-		shell_exec('tar cvzf freeswitch '.$backup_dir.'/backup.tgz');
-	}
-	session_cache_limiter('public');
-	$fd = fopen($tmp.$filename, "rb");
-	header("Content-Type: binary/octet-stream");
-	header("Content-Length: " . filesize($tmp.$filename));
-	header('Content-Disposition: attachment; filename="'.$filename.'"');
-	fpassthru($fd);
-	exit;
-}
-
 //show the content
 	require_once "resources/header.php";
 	$document['title'] = $text['title-sip-status'];
path: app/sip_status/sip_status.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16971
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-22
File: app/messages/messages_thread.php
Commit message: Update messages_thread.php
Commit author: FusionPBX

Vulnerable version (before fix):
  //get number of messages to load 	$number = preg_replace('{[\D]}', '', $_GET['number']); 	$contact_uuid = $_GET['contact_uuid'];  //set refresh flag 	$refresh = $_GET['refresh'] == 'true' ? true : false; 		} 	}  ?>\ No newline at end of file

Fixed version (after fix):
  //get number of messages to load 	$number = preg_replace('{[\D]}', '', $_GET['number']); 	$contact_uuid = (is_uuid($_GET['contact_uuid'])) ? $_GET['contact_uuid'] : null;  //set refresh flag 	$refresh = $_GET['refresh'] == 'true' ? true : false; 		} 	} \ No newline at end of file ?>

Patch:
patch: @@ -41,7 +41,7 @@
 
 //get number of messages to load
 	$number = preg_replace('{[\D]}', '', $_GET['number']);
-	$contact_uuid = $_GET['contact_uuid'];
+	$contact_uuid = (is_uuid($_GET['contact_uuid'])) ? $_GET['contact_uuid'] : null;
 
 //set refresh flag
 	$refresh = $_GET['refresh'] == 'true' ? true : false;
@@ -335,4 +335,4 @@
 		}
 	}
 
-?>
\ No newline at end of file
+?>
path: app/messages/messages_thread.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16973
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-22
File: app/contacts/contact_edit.php
Commit message: Update contact_edit.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	} 	echo "</b></td>\n"; 	echo "<td valign='top' width='70%' align='right'>\n"; 	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 	if ($action == "update") { 		if (permission_exists('contact_time_add')) { 			//detect timer state (and start time)

Fixed version (after fix):
 	} 	echo "</b></td>\n"; 	echo "<td valign='top' width='70%' align='right'>\n"; 	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n"; 	if ($action == "update") { 		if (permission_exists('contact_time_add')) { 			//detect timer state (and start time)

Patch:
patch: @@ -346,7 +346,7 @@
 	}
 	echo "</b></td>\n";
 	echo "<td valign='top' width='70%' align='right'>\n";
-	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n";
 	if ($action == "update") {
 		if (permission_exists('contact_time_add')) {
 			//detect timer state (and start time)
path: app/contacts/contact_edit.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16974
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/contacts/contact_times.php
Commit message: Update contact_times.php
Commit author: FusionPBX

Vulnerable version (before fix):
 		exit; 	}  //get the contact list 	$sql = "select ct.*, u.username, u.domain_uuid as user_domain_uuid "; 	$sql .= "from v_contact_times as ct, v_users as u "; 	echo "<td class='list_control_icons' nowrap>"; 	echo 	img_spacer('25px', '1px'); 	if (permission_exists('contact_time_add')) { 		echo "<a href='contact_time_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo img_spacer('25px', '1px');

Fixed version (after fix):
 		exit; 	}  //set the uuid 	if (is_uuid($_GET['id'])) { 		$contact_uuid = $_GET['id']; 	}  //get the contact list 	$sql = "select ct.*, u.username, u.domain_uuid as user_domain_uuid "; 	$sql .= "from v_contact_times as ct, v_users as u "; 	echo "<td class='list_control_icons' nowrap>"; 	echo 	img_spacer('25px', '1px'); 	if (permission_exists('contact_time_add')) { 		echo "<a href='contact_time_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo img_spacer('25px', '1px');

Patch:
patch: @@ -38,6 +38,11 @@
 		exit;
 	}
 
+//set the uuid
+	if (is_uuid($_GET['id'])) {
+		$contact_uuid = $_GET['id'];
+	}
+
 //get the contact list
 	$sql = "select ct.*, u.username, u.domain_uuid as user_domain_uuid ";
 	$sql .= "from v_contact_times as ct, v_users as u ";
@@ -74,7 +79,7 @@
 	echo "<td class='list_control_icons' nowrap>";
 	echo 	img_spacer('25px', '1px');
 	if (permission_exists('contact_time_add')) {
-		echo "<a href='contact_time_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='contact_time_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo img_spacer('25px', '1px');
path: app/contacts/contact_times.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16975
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-23
File: app/contacts/contact_notes.php
Commit message: Update contact_notes.php
Commit author: FusionPBX

Vulnerable version (before fix):
 		exit; 	}  //show the content 	echo "<table width='100%' border='0'>\n"; 	echo "<tr>\n"; 	echo "<th style='text-align: right;'>".$text['label-note_user']."</th>\n"; 	echo "<td class='list_control_icons'>"; 	if (permission_exists('contact_note_add')) { 		echo "<a href='contact_note_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	echo "</td>\n"; 	echo "</tr>\n";

Fixed version (after fix):
 		exit; 	}  //set the uuid 	if (is_uuid($_GET['id'])) { 		$contact_uuid = $_GET['id']; 	}  //show the content 	echo "<table width='100%' border='0'>\n"; 	echo "<tr>\n"; 	echo "<th style='text-align: right;'>".$text['label-note_user']."</th>\n"; 	echo "<td class='list_control_icons'>"; 	if (permission_exists('contact_note_add')) { 		echo "<a href='contact_note_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	echo "</td>\n"; 	echo "</tr>\n";

Patch:
patch: @@ -38,6 +38,11 @@
 		exit;
 	}
 
+//set the uuid
+	if (is_uuid($_GET['id'])) {
+		$contact_uuid = $_GET['id'];
+	}
+
 //show the content
 	echo "<table width='100%' border='0'>\n";
 	echo "<tr>\n";
@@ -70,7 +75,7 @@
 	echo "<th style='text-align: right;'>".$text['label-note_user']."</th>\n";
 	echo "<td class='list_control_icons'>";
 	if (permission_exists('contact_note_add')) {
-		echo "<a href='contact_note_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='contact_note_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	echo "</td>\n";
 	echo "</tr>\n";
path: app/contacts/contact_notes.php
Vulnerability: In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16977
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-23
File: app/extensions/extension_imports.php
Commit message: Update extension_imports.php
Commit author: FusionPBX

Vulnerable version (before fix):
 function get_parent($schema,$table_name) { 	echo "		".$text['description-import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='extensions.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Fixed version (after fix):
 function get_parent($schema,$table_name) { 	echo "		".$text['description-import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='extensions.php'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Patch:
patch: @@ -358,7 +358,7 @@ function get_parent($schema,$table_name) {
 	echo "		".$text['description-import']."\n";
 	echo "	</td>\n";
 	echo "	<td valign='top' width='70%' align='right'>\n";
-	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='extensions.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='extensions.php'\" value='".$text['button-back']."'>\n";
 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n";
 	echo "	</td>\n";
 	echo "	</tr>\n";
path: app/extensions/extension_imports.php
Vulnerability: In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16979
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/contacts/contact_urls.php
Commit message: Update contact_urls.php
Commit author: FusionPBX

Vulnerable version (before fix):
 		exit; 	}  //show the content 	echo "<table width='100%' border='0'>\n"; 	echo "<tr>\n"; 	echo "<th>".$text['label-url_description']."</th>\n"; 	echo "<td class='list_control_icons'>"; 	if (permission_exists('contact_url_add')) { 		echo "<a href='contact_url_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	echo "</td>\n"; 	echo "</tr>\n";

Fixed version (after fix):
 		exit; 	}  //set the uuid 	if (is_uuid($_GET['id'])) { 		$contact_uuid = $_GET['id']; 	}  //show the content 	echo "<table width='100%' border='0'>\n"; 	echo "<tr>\n"; 	echo "<th>".$text['label-url_description']."</th>\n"; 	echo "<td class='list_control_icons'>"; 	if (permission_exists('contact_url_add')) { 		echo "<a href='contact_url_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	echo "</td>\n"; 	echo "</tr>\n";

Patch:
patch: @@ -38,6 +38,11 @@
 		exit;
 	}
 
+//set the uuid
+	if (is_uuid($_GET['id'])) {
+		$contact_uuid = $_GET['id'];
+	}
+
 //show the content
 	echo "<table width='100%' border='0'>\n";
 	echo "<tr>\n";
@@ -69,7 +74,7 @@
 	echo "<th>".$text['label-url_description']."</th>\n";
 	echo "<td class='list_control_icons'>";
 	if (permission_exists('contact_url_add')) {
-		echo "<a href='contact_url_edit.php?contact_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='contact_url_edit.php?contact_uuid=".urlencode($contact_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	echo "</td>\n";
 	echo "</tr>\n";
path: app/contacts/contact_urls.php
Vulnerability: In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16991
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/edit/filedelete.php
Commit message: Update filedelete.php
Commit author: FusionPBX

Vulnerable version (before fix):
 		echo "				<td>".$text['label-path']."</td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td>".$folder."</td>"; 		echo "			</tr>"; 		echo "		</table>"; 		echo "		<br />"; 		echo "				<td>".$text['label-file-name']."</td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td><input type='text' name='file' value='".$file."'></td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td colspan='1' align='right'>"; 		echo "					<input type='hidden' name='folder' value='$folder'>"; 		echo "					<input type='hidden' name='token' id='token' value='". $_SESSION['token']. "'>"; 		echo "					<input type='submit' value='".$text['button-del-file']."'>"; 		echo "				</td>"; 		//include the footer 		require_once "footer.php"; 	}  ?>

Fixed version (after fix):
 		echo "				<td>".$text['label-path']."</td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td>".escape($folder)."</td>"; 		echo "			</tr>"; 		echo "		</table>"; 		echo "		<br />"; 		echo "				<td>".$text['label-file-name']."</td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td><input type='text' name='file' value='".escape($file)."'></td>"; 		echo "			</tr>"; 		echo "			<tr>"; 		echo "				<td colspan='1' align='right'>"; 		echo "					<input type='hidden' name='folder' value='".escape($folder)."'>"; 		echo "					<input type='hidden' name='token' id='token' value='". $_SESSION['token']. "'>"; 		echo "					<input type='submit' value='".$text['button-del-file']."'>"; 		echo "				</td>"; 		//include the footer 		require_once "footer.php"; 	} ?>

Patch:
patch: @@ -81,7 +81,7 @@
 		echo "				<td>".$text['label-path']."</td>";
 		echo "			</tr>";
 		echo "			<tr>";
-		echo "				<td>".$folder."</td>";
+		echo "				<td>".escape($folder)."</td>";
 		echo "			</tr>";
 		echo "		</table>";
 		echo "		<br />";
@@ -90,11 +90,11 @@
 		echo "				<td>".$text['label-file-name']."</td>";
 		echo "			</tr>";
 		echo "			<tr>";
-		echo "				<td><input type='text' name='file' value='".$file."'></td>";
+		echo "				<td><input type='text' name='file' value='".escape($file)."'></td>";
 		echo "			</tr>";
 		echo "			<tr>";
 		echo "				<td colspan='1' align='right'>";
-		echo "					<input type='hidden' name='folder' value='$folder'>";
+		echo "					<input type='hidden' name='folder' value='".escape($folder)."'>";
 		echo "					<input type='hidden' name='token' id='token' value='". $_SESSION['token']. "'>";
 		echo "					<input type='submit' value='".$text['button-del-file']."'>";
 		echo "				</td>";
@@ -106,5 +106,4 @@
 		//include the footer
 		require_once "footer.php";
 	}
-
 ?>
path: app/edit/filedelete.php