From 5328d4a2f25a6503f9bfd98dc6d01aa81ad88977 Mon Sep 17 00:00:00 2001
From: Remigijus Kiminas <remdex@gmail.com>
Date: Mon, 14 Jun 2021 10:21:40 -0400
Subject: [PATCH] Fix XSS issue for FAQ user posted content

---
 lhc_web/design/defaulttheme/tpl/lhfaq/form.tpl.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lhc_web/design/defaulttheme/tpl/lhfaq/form.tpl.php b/lhc_web/design/defaulttheme/tpl/lhfaq/form.tpl.php
index db0be75b8f..5011cab28d 100644
--- a/lhc_web/design/defaulttheme/tpl/lhfaq/form.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhfaq/form.tpl.php
@@ -2,27 +2,27 @@
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','Question');?></label>
-<textarea class="form-control" rows="5" cols="50" name="question"><?php echo htmlspecialchars($faq->question)?></textarea>
+<textarea ng-non-bindable class="form-control" rows="5" cols="50" name="question"><?php echo htmlspecialchars($faq->question)?></textarea>
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','Answer');?></label>
-<textarea class="form-control" rows="5" cols="50" name="answer"><?php echo htmlspecialchars($faq->answer)?></textarea>
+<textarea ng-non-bindable class="form-control" rows="5" cols="50" name="answer"><?php echo htmlspecialchars($faq->answer)?></textarea>
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','URL, enter * at the end for the wildcard');?>:</label>
-<input type="text" class="form-control" name="URL" value="<?php echo htmlspecialchars($faq->url)?>" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','The URL where this question should appear, leave it empty for all');?>">
+<input ng-non-bindable type="text" class="form-control" name="URL" value="<?php echo htmlspecialchars($faq->url)?>" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','The URL where this question should appear, leave it empty for all');?>">
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','Submitter e-mail');?>:</label>
-<input class="form-control" type="text" name="Email" value="<?php echo htmlspecialchars($faq->email)?>">
+<input ng-non-bindable class="form-control" type="text" name="Email" value="<?php echo htmlspecialchars($faq->email)?>">
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('faq/new','Identifier, can be used to filter questions by identifier');?>:</label>
-<input class="form-control" type="text" name="Identifier" value="<?php echo htmlspecialchars($faq->identifier)?>">
+<input ng-non-bindable class="form-control" type="text" name="Identifier" value="<?php echo htmlspecialchars($faq->identifier)?>">
 </div>
 
 <div class="form-group">