From c558c6e9e7fa230095f3035a1933ebc8234f1dd7 Mon Sep 17 00:00:00 2001
From: Marcel Folaron <marcel@leantime.io>
Date: Sat, 16 Apr 2022 12:38:24 -0400
Subject: [PATCH] misc escape issues

---
 .../templates/submodules/generalComment.sub.php |  1 +
 .../leancanvas/templates/showCanvas.tpl.php     |  2 +-
 .../projects/repositories/class.projects.php    |  6 ------
 src/domain/projects/templates/showAll.tpl.php   |  4 ++--
 .../retrospectives/templates/showBoards.tpl.php |  2 +-
 .../tickets/templates/milestoneDialog.tpl.php   |  2 +-
 src/domain/users/controllers/class.delUser.php  | 17 ++++++++++++++---
 src/domain/users/templates/delUser.tpl.php      |  1 +
 src/domain/users/templates/newUser.tpl.php      |  4 ++--
 9 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/src/domain/comments/templates/submodules/generalComment.sub.php b/src/domain/comments/templates/submodules/generalComment.sub.php
index b1cfc7ea4..fa7631d92 100644
--- a/src/domain/comments/templates/submodules/generalComment.sub.php
+++ b/src/domain/comments/templates/submodules/generalComment.sub.php
@@ -104,6 +104,7 @@ class="deleteComment">
 </form>
 
 <script type='text/javascript'>
+    leantime.generalController.initSimpleEditor();
     function toggleCommentBoxes(id) {
         if (id == 0) {
             jQuery('#mainToggler').hide();
diff --git a/src/domain/leancanvas/templates/showCanvas.tpl.php b/src/domain/leancanvas/templates/showCanvas.tpl.php
index dceff9ad8..72596b236 100644
--- a/src/domain/leancanvas/templates/showCanvas.tpl.php
+++ b/src/domain/leancanvas/templates/showCanvas.tpl.php
@@ -39,7 +39,7 @@
                                     $canvasTitle = $canvasRow["title"];
                                     echo" selected='selected' ";
                                 }
-                                echo">".$canvasRow["title"]."</option>"; ?>
+                                echo">".$this->escape($canvasRow["title"])."</option>"; ?>
 
                             <?php }     ?>
                         </select><br />
diff --git a/src/domain/projects/repositories/class.projects.php b/src/domain/projects/repositories/class.projects.php
index 005668247..2b16616ed 100644
--- a/src/domain/projects/repositories/class.projects.php
+++ b/src/domain/projects/repositories/class.projects.php
@@ -52,12 +52,6 @@ class projects
          * @access public
          */
 
-        private $encryptionMethod = 'AES-256-CBC';
-
-        private $secrethash = 'z5xXjI?maCHMGXW2neV8?0T<uD&<N4$j!K/W$V8(q~';
-
-        private $iv = '123';
-
         function __construct()
         {
             $config = new core\config();
diff --git a/src/domain/projects/templates/showAll.tpl.php b/src/domain/projects/templates/showAll.tpl.php
index 11faa3682..48a278978 100644
--- a/src/domain/projects/templates/showAll.tpl.php
+++ b/src/domain/projects/templates/showAll.tpl.php
@@ -45,9 +45,9 @@
 				<tr class='gradeA'>
 					
 					<td style="padding:6px;">
-						<?php echo $this->displayLink('projects.changeCurrentProject',$row['name'], array('id' => $row['id'])) ?>
+						<?php echo $this->displayLink('projects.changeCurrentProject',$this->escape($row['name']), array('id' => $row['id'])) ?>
 					<td>
-						<?php echo $this->displayLink('clients.showClient',$row['clientName'], array('id' => $row['clientId']), NULL, true) ?>
+						<?php echo $this->displayLink('clients.showClient',$this->escape($row['clientName']), array('id' => $row['clientId']), NULL, true) ?>
 					</td>
                     <td class="center"><?php if($row['state'] == -1) echo "Closed"; else { echo "Active"; } ?></td>
 					<td class="center"><?php echo $row['numberOfTickets']; ?></td>
diff --git a/src/domain/retrospectives/templates/showBoards.tpl.php b/src/domain/retrospectives/templates/showBoards.tpl.php
index e19ba209f..b117c6660 100644
--- a/src/domain/retrospectives/templates/showBoards.tpl.php
+++ b/src/domain/retrospectives/templates/showBoards.tpl.php
@@ -38,7 +38,7 @@
                                     $canvasTitle = $canvasRow["title"];
                                     echo" selected='selected' ";
                                 }
-                                echo">".$canvasRow["title"]."</option>";
+                                echo">".$this->escape($canvasRow["title"])."</option>";
 
                                 ?>
 
diff --git a/src/domain/tickets/templates/milestoneDialog.tpl.php b/src/domain/tickets/templates/milestoneDialog.tpl.php
index 4c5fe8b00..3030c8036 100644
--- a/src/domain/tickets/templates/milestoneDialog.tpl.php
+++ b/src/domain/tickets/templates/milestoneDialog.tpl.php
@@ -51,7 +51,7 @@
                     if ($currentMilestone->dependingTicketId == $milestoneRow->id) { echo " selected='selected' ";
                     }
 
-                    echo ">" . $milestoneRow->headline . " </option>";
+                    echo ">" . $this->escape($milestoneRow->headline) . " </option>";
 
                 }
             }
diff --git a/src/domain/users/controllers/class.delUser.php b/src/domain/users/controllers/class.delUser.php
index 69d533100..c0e9c3280 100644
--- a/src/domain/users/controllers/class.delUser.php
+++ b/src/domain/users/controllers/class.delUser.php
@@ -32,14 +32,25 @@ public function run()
                     //Delete User
                     if (isset($_POST['del']) === true) {
 
-                        $userRepo->deleteUser($id);
+                        if(isset($_POST[$_SESSION['formTokenName']]) && $_POST[$_SESSION['formTokenName']] == $_SESSION['formTokenValue']) {
 
-                        $tpl->setNotification($language->__("notifications.user_deleted"), "success");
+                            $userRepo->deleteUser($id);
 
-                        $tpl->redirect(BASE_URL."/users/showAll");
+                            $tpl->setNotification($language->__("notifications.user_deleted"), "success");
+
+                            $tpl->redirect(BASE_URL."/users/showAll");
+
+                        }else{
+                            $tpl->setNotification($language->__("notification.form_token_incorrect"), 'error');
+                        }
 
                     }
 
+                    //Sensitive Form, generate form tokens
+                    $permitted_chars = '0123456789abcdefghijklmnopqrstuvwxyz';
+                    $_SESSION['formTokenName'] = substr(str_shuffle($permitted_chars), 0, 32);
+                    $_SESSION['formTokenValue'] = substr(str_shuffle($permitted_chars), 0, 32);
+
                     //Assign variables
                     $tpl->assign('user', $user);
 
diff --git a/src/domain/users/templates/delUser.tpl.php b/src/domain/users/templates/delUser.tpl.php
index 6f67cf0ef..e82270724 100644
--- a/src/domain/users/templates/delUser.tpl.php
+++ b/src/domain/users/templates/delUser.tpl.php
@@ -20,6 +20,7 @@
         <div class="widgetcontent">
 
             <form method="post">
+                <input type="hidden" name="<?=$_SESSION['formTokenName']?>" value="<?=$_SESSION['formTokenValue']?>" />
                 <p><?php echo $this->__('text.confirm_user_deletion'); ?></p><br />
                 <input type="submit" value="<?php echo $this->__('buttons.yes_delete'); ?>" name="del" class="button" />
                 <a class="btn btn-primary" href="<?=BASE_URL ?>/users/showAll"><?php echo $this->__('buttons.back'); ?></a>
diff --git a/src/domain/users/templates/newUser.tpl.php b/src/domain/users/templates/newUser.tpl.php
index 28c0aafe6..87920a9c2 100644
--- a/src/domain/users/templates/newUser.tpl.php
+++ b/src/domain/users/templates/newUser.tpl.php
@@ -121,7 +121,7 @@
                             <?php } ?>
                             <?php foreach($this->get('clients') as $client): ?>
                                 <option value="<?php echo $client['id'] ?>" <?php if ($client['id'] == $values['clientId']) : ?>selected="selected"<?php
-                               endif; ?>><?php echo $client['name'] ?></option>
+                               endif; ?>><?php $this->e($client['name']) ?></option>
                             <?php endforeach; ?>
                         </select><br/>
 
@@ -151,7 +151,7 @@
 
                                                             <?php foreach($this->get('allProjects') as $row){ ?>
                                                                 <?php if(is_array($projects) === true && in_array($row['id'], $projects) === false) { ?>
-                                                                    <option value="<?php echo $row['id'] ?>"><?php echo $row['name']; ?> / <?php echo $row['clientName']; ?></option>
+                                                                    <option value="<?php echo $row['id'] ?>"><?php $this->e($row['name']); ?> / <?php $this->e($row['clientName']); ?></option>
                                                                 <?php } ?>
                                                             <?php } ?>