Minor xss and non-admin access control fix.

include/utils/VtlibUtils.php

@@ -648,6 +648,7 @@ function vtlib_purify($input, $ignore=false) {
 				}
 			} else { // Simple type
 				$value = $__htmlpurifier_instance->purify($input);
+				$value = purifyHtmlEventAttributes($value);
 			}
 		}
 		$purified_cache[$md5OfInput] = $value;
@@ -656,6 +657,23 @@ function vtlib_purify($input, $ignore=false) {
 	return $value;
 }
 
+/**
+ * To purify malicious html event attributes
+ * @param <String> $value
+ * @return <String>
+ */
+function purifyHtmlEventAttributes($value){
+    $htmlEventAttributes = "onerror|onblur|onchange|oncontextmenu|onfocus|oninput|oninvalid|".
+                        "onreset|onsearch|onselect|onsubmit|onkeydown|onkeypress|onkeyup|".
+                        "onclick|ondblclick|ondrag|ondragend|ondragenter|ondragleave|ondragover|".
+                        "ondragstart|ondrop|onmousedown|onmousemove|onmouseout|onmouseover|".
+                        "onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste";
+    if(preg_match("/\s(".$htmlEventAttributes.")\s*=/i", $value)) {
+        $value = str_replace("=", "&equals;", $value);
+    }
+    return $value;
+}
+
 /**
  * Function to return the valid SQl input.
  * @param <String> $string
@@ -704,4 +722,8 @@ function vtlib_module_icon($modulename){
 	return "modules/Vtiger/Vtiger.png";
 }
 
+function vtlib_mime_content_type($filename) {
+	return Vtiger_Functions::mime_content_type($filename);
+}
+
 ?>

modules/Users/actions/Save.php

@@ -15,8 +15,22 @@ class Users_Save_Action extends Vtiger_Save_Action {
 		$record = $request->get('record');
 		$recordModel = Vtiger_Record_Model::getInstanceById($record, $moduleName);
 		$currentUserModel = Users_Record_Model::getCurrentUserModel();
-		if(!Users_Privileges_Model::isPermitted($moduleName, 'Save', $record) || ($recordModel->isAccountOwner() && 
-							$currentUserModel->get('id') != $recordModel->getId() && !$currentUserModel->isAdminUser())) {
+
+		// Check for operation access.
+		$allowed = Users_Privileges_Model::isPermitted($moduleName, 'Save', $record);
+		
+		if ($allowed) {
+			// Deny access if not administrator or account-owner or self
+			if(!$currentUserModel->isAdminUser() && !$recordModel->isAccountOwner()) {
+				if (empty($record)) {
+					$allowed = false;
+				} else if ($currentUserModel->get('id') != $recordModel->getId()) {
+					$allowed = false;
+				}
+			}
+		}
+
+		if(!$allowed) {
 			throw new AppException('LBL_PERMISSION_DENIED');
 		}
 	}