From b1c6a748333e25c7ccbba7265ab0a7c99fecd493 Mon Sep 17 00:00:00 2001
From: Remigijus Kiminas <remdex@gmail.com>
Date: Wed, 25 Aug 2021 23:16:21 -0400
Subject: [PATCH] Escape settings fields

---
 .../defaulttheme/tpl/lhchatbox/generalsettings.tpl.php    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php
index 9dc1d9c1c6..9eedf62a01 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php
@@ -14,17 +14,17 @@
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Default new chatbox name');?></label>
-<input class="form-control" type="text" name="DefaultName" value="<?php (isset($chatbox_data['chatbox_default_name']) && $chatbox_data['chatbox_default_name'] != '') ? print $chatbox_data['chatbox_default_name'] : print 'Chatbox' ?>" />
+<input class="form-control" type="text" name="DefaultName" value="<?php (isset($chatbox_data['chatbox_default_name']) && $chatbox_data['chatbox_default_name'] != '') ? print htmlspecialchars($chatbox_data['chatbox_default_name']) : print 'Chatbox' ?>" />
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Default operator name');?></label>
-<input class="form-control" type="text" name="DefaultOperatorName" value="<?php (isset($chatbox_data['chatbox_default_opname']) && $chatbox_data['chatbox_default_opname'] != '') ? print $chatbox_data['chatbox_default_opname'] : print 'Manager' ?>" />
+<input class="form-control" type="text" name="DefaultOperatorName" value="<?php (isset($chatbox_data['chatbox_default_opname']) && $chatbox_data['chatbox_default_opname'] != '') ? print htmlspecialchars($chatbox_data['chatbox_default_opname']) : print 'Manager' ?>" />
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Messages limit in the chatbox');?></label>
-<input class="form-control" type="text" name="MessagesLimit" value="<?php (isset($chatbox_data['chatbox_msg_limit']) && $chatbox_data['chatbox_msg_limit'] != '') ? print $chatbox_data['chatbox_msg_limit'] : print 100 ?>" />
+<input class="form-control" type="text" name="MessagesLimit" value="<?php (isset($chatbox_data['chatbox_msg_limit']) && $chatbox_data['chatbox_msg_limit'] != '') ? print htmlspecialchars($chatbox_data['chatbox_msg_limit']) : print 100 ?>" />
 </div>
 
 <div class="form-group">
@@ -33,7 +33,7 @@
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Secret hash, this is used when auto creation is disabled');?>, <a rel="noreferrer" href="http://livehelperchat.com/documentation-6c.html"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','more information on how to use it');?></a></label>
-<input class="form-control" type="text" name="SecretHash" value="<?php (isset($chatbox_data['chatbox_secret_hash']) && $chatbox_data['chatbox_secret_hash'] != '') ? print $chatbox_data['chatbox_secret_hash'] : print erLhcoreClassChat::generateHash() ?>" />
+<input class="form-control" type="text" name="SecretHash" value="<?php (isset($chatbox_data['chatbox_secret_hash']) && $chatbox_data['chatbox_secret_hash'] != '') ? print htmlspecialchars($chatbox_data['chatbox_secret_hash']) : print erLhcoreClassChat::generateHash() ?>" />
 </div>
 
 <input type="submit" class="btn btn-secondary" name="StoreChatboxSettings" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />