From 78e0470100a6cb143fe9af2e336dce80e4620960 Mon Sep 17 00:00:00 2001 From: Gary Allan Date: Mon, 6 Mar 2023 21:08:01 +0000 Subject: [PATCH] Bugfix: XSS (stored) in user widget settings Reported by Peng Zhou @zpbrent --- app/dashboard/index.php | 18 +++++++++--------- functions/classes/class.Common.php | 2 +- misc/CHANGELOG | 1 + 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/app/dashboard/index.php b/app/dashboard/index.php index 9c78bfaaf..bd5bc7ed9 100755 --- a/app/dashboard/index.php +++ b/app/dashboard/index.php @@ -118,8 +118,8 @@ $m=0; //to calculate chunk index foreach($uwidgets as $uk=>$uv) { - //get fetails - $wdet = (array) $widgets[$uv]; + //get details + $wdet = isset($widgets[$uv]) ? (array) $widgets[$uv] : ['wsize' => 6]; if(is_blank($wdet['wsize'])) { $wsize = 6; } else { $wsize = $wdet['wsize']; } @@ -148,18 +148,18 @@ foreach($uwidgetschunk as $w) { # print itams in a row foreach($w as $c) { - /* print items */ - $wdet = (array) $widgets[$c]; if(array_key_exists($c, $widgets)) { + $wdet = (array) $widgets[$c]; + //reset size if not set if(is_blank($wdet['wsize'])) { $wdet['wsize'] = 6; } - print "
"; + print "
"; print "
"; // href? - if($wdet['whref']=="yes") { print "

"._($wdet['wtitle'])."

"; } - else { print "

"._($wdet['wtitle'])."

"; } + if($wdet['whref']=="yes") { print "

"._(escape_input($wdet['wtitle']))."

"; } + else { print "

"._(escape_input($wdet['wtitle']))."

"; } print "
"; print "
"._('Loading widget')."
"; print "
"; @@ -169,9 +169,9 @@ } # invalid widget else { - print "
"; + print "
"; print "
"; - print "

Invalid widget $c

"; + print "

Invalid widget ".escape_input($c)."

"; print "
"; print "
"; } diff --git a/functions/classes/class.Common.php b/functions/classes/class.Common.php index 96055336e..a9a31602d 100644 --- a/functions/classes/class.Common.php +++ b/functions/classes/class.Common.php @@ -674,7 +674,7 @@ public function noxss_html($html) { if ($dom->loadHTML("".$html."", LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD | LIBXML_NOBLANKS | LIBXML_NOWARNING | LIBXML_NOERROR) === false) return ""; - $banned_elements = ['script', 'iframe', 'embed']; + $banned_elements = ['script', 'iframe', 'embed', 'object']; $remove_elements = []; $elements = $dom->getElementsByTagName('*'); diff --git a/misc/CHANGELOG b/misc/CHANGELOG index d10bb5ca1..76c0aa4f0 100755 --- a/misc/CHANGELOG +++ b/misc/CHANGELOG @@ -12,6 +12,7 @@ + XSS (reflected) in 'bw-calulator-result.php'; + XSS (reflected) by invalid email address response; + XSS (reflected) by /app/tools/subnet-masks/popup.php (#3738); + + XSS (stored) in user widget settings; + XSS and LDAP injection in ad-search-result.php; + XSS and LDAP injection in ad-search-group-result.php; + Restrict find_full_subnets.php to CLI;