From f1b229549fe0f32205d0ee5899a706dcd6a81df6 Mon Sep 17 00:00:00 2001
From: root <you@example.com>
Date: Fri, 3 May 2024 18:08:58 +0530
Subject: [PATCH] Fixes : Xss payload in Users last name and first name issue
is fixed
---
include/utils/VtlibUtils.php | 29 +++++-----------------------
layouts/v7/modules/Vtiger/Header.tpl | 2 +-
2 files changed, 6 insertions(+), 25 deletions(-)
diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php
index 87b4ba224..7b4640319 100644
--- a/include/utils/VtlibUtils.php
+++ b/include/utils/VtlibUtils.php
@@ -751,32 +751,13 @@ function str_replace_json($search, $replace, $subject){
*/
function purifyHtmlEventAttributes($value,$replaceAll = false){
-$tmp_markers = $office365ImageMarkers = array();
-$value = Vtiger_Functions::strip_base64_data($value,true,$tmp_markers);
-$value = Vtiger_Functions::stripInlineOffice365Image($value,true,$office365ImageMarkers);
-$tmp_markers = array_merge($tmp_markers, $office365ImageMarkers);
-
-$htmlEventAttributes = "onerror|onblur|onchange|oncontextmenu|onfocus|oninput|oninvalid|onresize|onauxclick|oncancel|oncanplay|oncanplaythrough|".
- "onreset|onsearch|onselect|onsubmit|onkeydown|onkeypress|onkeyup|onclose|oncuechange|ondurationchange|onemptied|onended|".
- "onclick|ondblclick|ondrag|ondragend|ondragenter|ondragleave|ondragover|ondragexit|onformdata|onloadeddata|onloadedmetadata|".
- "ondragstart|ondrop|onmousedown|onmousemove|onmouseout|onmouseover|onmouseenter|onmouseleave|onpause|onplay|onplaying|".
- "onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste|onload|onprogress|onratechange|onsecuritypolicyviolation|".
- "onselectionchange|onabort|onselectstart|onstart|onfinish|onloadstart|onshow|onreadystatechange|onseeked|onslotchange|".
- "onseeking|onstalled|onsubmit|onsuspend|ontimeupdate|ontoggle|onvolumechange|onwaiting|onwebkitanimationend|onstorage|".
- "onwebkitanimationiteration|onwebkitanimationstart|onwebkittransitionend|onafterprint|onbeforeprint|onbeforeunload|".
- "onhashchange|onlanguagechange|onmessage|onmessageerror|onoffline|ononline|onpagehide|onpageshow|onpopstate|onunload|".
- "onrejectionhandled|onunhandledrejection|onloadend|onpointerenter|ongotpointercapture|onlostpointercapture|onpointerdown|".
- "onpointermove|onpointerup|onpointercancel|onpointerover|onpointerout|onpointerleave|onactivate|onafterscriptexecute|".
- "onanimationcancel|onanimationend|onanimationiteration|onanimationstart|onbeforeactivate|onbeforedeactivate|onbeforescriptexecute|".
- "onbegin|onbounce|ondeactivate|onend|onfocusin|onfocusout|onrepeat|ontransitioncancel|ontransitionend|ontransitionrun|".
- "ontransitionstart|onbeforecopy|onbeforecut|onbeforepaste|onfullscreenchange|onmozfullscreenchange|onpointerrawupdate|".
- "ontouchend|ontouchmove|ontouchstart";
-
+ $tmp_markers = $office365ImageMarkers = array();
+ $value = Vtiger_Functions::strip_base64_data($value,true,$tmp_markers);
+ $value = Vtiger_Functions::stripInlineOffice365Image($value,true,$office365ImageMarkers);
+ $tmp_markers = array_merge($tmp_markers, $office365ImageMarkers);
// remove malicious html attributes with its value.
if ($replaceAll) {
- $regex = '\s*[=&%#]\s*(?:"[^"]*"[\'"]*|\'[^\']*\'[\'"]*|[^]*[\s\/>])*/i';
- $value = preg_replace("/\s*(" . $htmlEventAttributes . ")" . $regex, '', $value);
-
+ $value = preg_replace('/\b(alert|on\w+)\s*\([^)]*\)|\s*(?:on\w+)=(".*?"|\'.*?\'|[^\'">\s]+)\s*/', '', $value);
//remove script tag with contents
$value = purifyScript($value);
//purify javascript alert from the tag contents
diff --git a/layouts/v7/modules/Vtiger/Header.tpl b/layouts/v7/modules/Vtiger/Header.tpl
index 6e5e79f46..5591664ff 100644
--- a/layouts/v7/modules/Vtiger/Header.tpl
+++ b/layouts/v7/modules/Vtiger/Header.tpl
@@ -61,7 +61,7 @@
{if $CURRENT_USER_MODEL}
_USERMETA = { 'id' : "{$CURRENT_USER_MODEL->get('id')}", 'menustatus' : "{$CURRENT_USER_MODEL->get('leftpanelhide')}",
'currency' : "{decode_html($USER_CURRENCY_SYMBOL)}", 'currencySymbolPlacement' : "{$CURRENT_USER_MODEL->get('currency_symbol_placement')}",
- 'currencyGroupingPattern' : "{$CURRENT_USER_MODEL->get('currency_grouping_pattern')}", 'truncateTrailingZeros' : "{$CURRENT_USER_MODEL->get('truncate_trailing_zeros')}",'userlabel':"{vtlib_purify(decode_html($CURRENT_USER_MODEL->get('userlabel')))}",};
+ 'currencyGroupingPattern' : "{$CURRENT_USER_MODEL->get('currency_grouping_pattern')}", 'truncateTrailingZeros' : "{$CURRENT_USER_MODEL->get('truncate_trailing_zeros')}",'userlabel':"{($CURRENT_USER_MODEL->get('userlabel'))}",};
{/if}
</script>
</head>
--
GitLab