Skip to content

Commit 016f486

Browse files
remdexremdex
committed
🔒 Escape user-controlled data in templates and sanitize webhook country codes
- Escape country_code, photo_path, email, lat/lon and operator image URLs with htmlspecialchars in chat/online user/user/export templates to prevent XSS ✨ - Cast btype to int in blocked users list title attribute - Sanitize country_code from webhook payloads: strip non-letters and limit to 2 chars to keep flag image paths safe
1 parent 9e006b3 commit 016f486

16 files changed

Lines changed: 23 additions & 23 deletions

‎lhc_web/design/defaulttheme/tpl/lhchat/blockedusers.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@
135135
<?php foreach ($items as $item) : ?>
136136
<tr>
137137
<td><?php echo $item->id?></td>
138-
<td title="<?php echo $item->btype?>">
138+
<td title="<?php echo (int)$item->btype?>">
139139

140140
<?php if (isset($enabled_log)) : ?>
141141
<a class="text-danger" target="_blank" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/blockedusers','Block history');?>" href="<?php echo erLhcoreClassDesign::baseurl('abstract/list')?>/Audit/(category)/block/(source)/lhc/(object_id)/<?php echo $item->id?>"><span class="material-icons me-0">history</span></a>

‎lhc_web/design/defaulttheme/tpl/lhchat/chat_tabs/information_rows/country_code.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
<a class="text-muted" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/adminchat','Location on map')?>" onclick="lhc.revealModal({'url':WWW_DIR_JAVASCRIPT+'chat/singleaction/<?php echo $chat->id?>/map'})"><span class="material-icons">place</span></a>
77
<?php endif;?>
88
<?php endif;?>
9-
<img src="<?php echo erLhcoreClassDesign::design('images/flags')?>/<?php echo $chat->country_code?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" />&nbsp;<?php echo htmlspecialchars($chat->chat_locale)?>
9+
<img src="<?php echo erLhcoreClassDesign::design('images/flags')?>/<?php echo htmlspecialchars($chat->country_code)?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" />&nbsp;<?php echo htmlspecialchars($chat->chat_locale)?>
1010
</div>
1111
<?php endif;?>

‎lhc_web/design/defaulttheme/tpl/lhchat/chat_tabs/map_tab.tpl.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
<div role="tabpanel" class="tab-pane<?php if ($chatTabsOrderDefault == 'map_tab_tab') print ' active';?>" id="map-tab-chat-<?php echo $chat->id?>">
44
<?php if ($chat->lat != 0 && $chat->lon) : ?>
55
<?php $geo_location_data = erLhcoreClassModelChatConfig::fetch('geo_location_data')->data; ?>
6-
<a target="_blank" href="//maps.google.com/maps?t=h&q=<?php echo $chat->lat?>,<?php echo $chat->lon?>&z=17&hl=en&z=11&t=m">
7-
<img id="chat-map-img-<?php echo $chat->id?>" data-src="//maps.google.com/maps/api/staticmap?<?php if (erConfigClassLhConfig::getInstance()->getSetting( 'site', 'maps_api_key', false)) {echo 'key=' , erConfigClassLhConfig::getInstance()->getSetting( 'site', 'maps_api_key', false) , '&';} elseif (isset($geo_location_data['gmaps_api_key'])) {echo 'key=' ,$geo_location_data['gmaps_api_key'], '&';}?>zoom=13&size=400x300&maptype=roadmap&center=<?php echo $chat->lat?>,<?php echo $chat->lon?>&sensor=false&markers=color:green|<?php echo $chat->lat?>,<?php echo $chat->lon?>" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg" alt="" title="<?php echo $chat->lat?>,<?php echo $chat->lon?>" />
6+
<a target="_blank" href="//maps.google.com/maps?t=h&q=<?php echo htmlspecialchars($chat->lat)?>,<?php echo htmlspecialchars($chat->lon)?>&z=17&hl=en&z=11&t=m">
7+
<img id="chat-map-img-<?php echo $chat->id?>" data-src="//maps.google.com/maps/api/staticmap?<?php if (erConfigClassLhConfig::getInstance()->getSetting( 'site', 'maps_api_key', false)) {echo 'key=' , erConfigClassLhConfig::getInstance()->getSetting( 'site', 'maps_api_key', false) , '&';} elseif (isset($geo_location_data['gmaps_api_key'])) {echo 'key=' ,$geo_location_data['gmaps_api_key'], '&';}?>zoom=13&size=400x300&maptype=roadmap&center=<?php echo htmlspecialchars($chat->lat)?>,<?php echo htmlspecialchars($chat->lon)?>&sensor=false&markers=color:green|<?php echo htmlspecialchars($chat->lat)?>,<?php echo htmlspecialchars($chat->lon)?>" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg" alt="" title="<?php echo htmlspecialchars($chat->lat)?>,<?php echo htmlspecialchars($chat->lon)?>" />
88
</a>
99
<script>
1010
$('#map-tab-chat-link-<?php echo $chat->id?>').click(function () {

‎lhc_web/design/defaulttheme/tpl/lhchat/chat_tabs/online_user_info_chats_list_list.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<?php $hasPrevChat = false; foreach (erLhcoreClassChat::getList(array('limit' => 100, 'filter' => array('online_user_id' => $online_user->id))) as $chatPrev) : ?>
33
<?php if ((!isset($chat) || $chat->id != $chatPrev->id) && (!isset($chat_id_present) || $chat_id_present != $chatPrev->id)) : $hasPrevChat = true;?>
44
<li>
5-
<?php if ( !empty($chatPrev->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo $chatPrev->country_code?>.png" alt="<?php echo htmlspecialchars($chatPrev->country_name)?>" title="<?php echo htmlspecialchars($chatPrev->country_name)?>" />&nbsp;<?php endif; ?>
5+
<?php if ( !empty($chatPrev->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo htmlspecialchars($chatPrev->country_code)?>.png" alt="<?php echo htmlspecialchars($chatPrev->country_name)?>" title="<?php echo htmlspecialchars($chatPrev->country_name)?>" />&nbsp;<?php endif; ?>
66
<a title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/syncadmininterface','Open in a new window');?>" class="material-icons" onclick="lhinst.startChatNewWindow('<?php echo $chatPrev->id;?>',$(this).attr('data-title'))" data-title="<?php echo htmlspecialchars($chatPrev->nick,ENT_QUOTES);?>">open_in_new</a><?php echo $chatPrev->id;?>. <?php echo htmlspecialchars($chatPrev->nick);?> (<?php echo date(erLhcoreClassModule::$dateDateHourFormat,$chatPrev->time);?>) (<?php echo htmlspecialchars($chatPrev->department);?>)
77
</li>
88
<?php endif; ?>

‎lhc_web/design/defaulttheme/tpl/lhchat/editchatconfig.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
55
<?php endif; ?>
66

7-
<form method="post" action="<?php echo erLhcoreClassDesign::baseurl('chat/editchatconfig')?>/<?php echo $systemconfig->identifier?>">
7+
<form method="post" action="<?php echo erLhcoreClassDesign::baseurl('chat/editchatconfig')?>/<?php echo htmlspecialchars($systemconfig->identifier)?>">
88

99
<?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
1010

‎lhc_web/design/defaulttheme/tpl/lhchat/lists.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161

6262
<span title="<?php echo $chat->id;?>" class="material-icons fs12 me-0<?php echo $chat->user_status_front == 2 ? ' icon-user-away' : ($chat->user_status_front == 0 ? ' icon-user-online' : ' icon-user-offline')?>" class="">&#xE3A6;</span>&nbsp;
6363

64-
<?php if ( !empty($chat->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo $chat->country_code?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" />&nbsp;<?php endif; ?>
64+
<?php if ( !empty($chat->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo htmlspecialchars($chat->country_code)?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" />&nbsp;<?php endif; ?>
6565
<a class="material-icons" id="preview-item-<?php echo $chat->id?>" data-list-navigate="true" onclick="lhc.previewChat(<?php echo $chat->id?>,this)">info_outline</a>
6666

6767
<a href="#/chat-id-<?php echo $chat->id?>" class="action-image material-icons" data-title="<?php echo htmlspecialchars($chat->nick,ENT_QUOTES);?>" onclick="lhinst.startChatNewWindow('<?php echo $chat->id;?>',$(this).attr('data-title'))" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/pendingchats','Open in a new window');?>">open_in_new</a>

‎lhc_web/design/defaulttheme/tpl/lhchat/lists/unread-chat-list.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<ul class="no-bullet fs12">
33
<?php foreach ($chats as $chat) : ?>
44
<li class="chat-row-<?php echo $chat->id;?>">
5-
<?php if ( !empty($chat->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo $chat->country_code?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" /><?php endif; ?>
5+
<?php if ( !empty($chat->country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo htmlspecialchars($chat->country_code)?>.png" alt="<?php echo htmlspecialchars($chat->country_name)?>" title="<?php echo htmlspecialchars($chat->country_name)?>" /><?php endif; ?>
66
<a class="material-icons" title="ID - <?php echo $chat->id;?>" onclick="lhc.previewChat('<?php echo $chat->id;?>')" >info_outline</a><a class="right-action-hide material-icons" data-title="<?php echo erLhcoreClassDesign::shrt($chat->nick,10,'...',30,ENT_QUOTES);?>" onclick="lhinst.startChat('<?php echo $chat->id;?>',$('#tabs'),$(this).attr('data-title'))" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/syncadmininterface','Add chat');?>">chat</a><a class="material-icons" data-title="<?php echo htmlspecialchars($chat->nick,ENT_QUOTES);?>" onclick="lhinst.startChatNewWindow('<?php echo $chat->id;?>',$(this).attr('data-title'))" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/syncadmininterface','Open in a new window');?>">open_in_new</a> <?php echo htmlspecialchars($chat->nick);?>, <?php echo $chat->time_created_front;?>, <?php echo htmlspecialchars($chat->department);?> | <?php
77
$diff = time()-$chat->last_user_msg_time;
88
$hours = floor($diff/3600);

‎lhc_web/design/defaulttheme/tpl/lhchat/online_user/online_user_info.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<div class="float-end col-6">
22
<p class="fs12">
3-
<?php if ( !empty($online_user->user_country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo $online_user->user_country_code?>.png" alt="<?php echo htmlspecialchars($online_user->user_country_name)?>" title="<?php echo htmlspecialchars($online_user->user_country_name)?>" /><?php endif; ?> (<?php
3+
<?php if ( !empty($online_user->user_country_code) ) : ?><img src="<?php echo erLhcoreClassDesign::design('images/flags');?>/<?php echo htmlspecialchars($online_user->user_country_code)?>.png" alt="<?php echo htmlspecialchars($online_user->user_country_name)?>" title="<?php echo htmlspecialchars($online_user->user_country_name)?>" /><?php endif; ?> (<?php
44
if (erLhcoreClassUser::instance()->hasAccessTo('lhchat','seeip')) {
55
echo htmlspecialchars($online_user->ip);
66
} else {

‎lhc_web/design/defaulttheme/tpl/lhchat/part/operator_profile.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<?php include(erLhcoreClassDesign::designtpl('lhchat/part/operator_profile_name_support_img.tpl.php'));?>
55
<?php elseif (isset($theme) && $theme !== false && $theme->operator_image_avatar !== false) : ?>
66
<?php if ($theme->operator_image_url !== false) : ?>
7-
<img width="48" height="48" src="<?php echo $theme->operator_image_url?>" alt="">
7+
<img width="48" height="48" src="<?php echo htmlspecialchars($theme->operator_image_url)?>" alt="">
88
<?php else : ?>
99
<img width="48" height="48" src="<?php echo erLhcoreClassSystem::getHost()?><?php echo erLhcoreClassDesign::baseurldirect('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($theme->bot_configuration_array['operator_avatar'])?>" alt="" />
1010
<?php endif; ?>

‎lhc_web/design/defaulttheme/tpl/lhchat/part/operator_profile_name_support_img.tpl.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?php if ($user->has_photo) : ?>
2-
<img width="48" height="48" src="<?php echo $user->photo_path?>" alt="<?php echo htmlspecialchars($user->name_support)?>" />
2+
<img width="48" height="48" src="<?php echo htmlspecialchars($user->photo_path)?>" alt="<?php echo htmlspecialchars($user->name_support)?>" />
33
<?php else : ?>
44
<img width="48" height="48" src="<?php echo erLhcoreClassSystem::getHost()?><?php echo erLhcoreClassDesign::baseurldirect('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($user->avatar)?>" alt="<?php echo htmlspecialchars($user->name_support)?>" />
55
<?php endif; ?>

0 commit comments

Comments
 (0)