diff --git a/client_document_details.php b/client_document_details.php index 79add887..09810852 100644 --- a/client_document_details.php +++ b/client_document_details.php @@ -2,6 +2,12 @@ require_once("inc_all_client.php"); +//Initialize the HTML Purifier to prevent XSS +require("plugins/htmlpurifier/HTMLPurifier.standalone.php"); +$purifier_config = HTMLPurifier_Config::createDefault(); +$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); + if (isset($_GET['document_id'])) { $document_id = intval($_GET['document_id']); } @@ -13,7 +19,8 @@ $row = mysqli_fetch_array($sql_document); $folder_name = htmlentities($row['folder_name']); $document_name = htmlentities($row['document_name']); -$document_content = $row['document_content']; +$document_content = $purifier->purify(html_entity_decode($row['document_content'])); +//$document_content = $row['document_content']; $document_created_at = htmlentities($row['document_created_at']); $document_updated_at = htmlentities($row['document_updated_at']); $document_folder_id = intval($row['document_folder_id']); diff --git a/client_document_edit_modal.php b/client_document_edit_modal.php index 3c0d969a..3abec2ba 100644 --- a/client_document_edit_modal.php +++ b/client_document_edit_modal.php @@ -17,7 +17,7 @@
- +
diff --git a/client_document_template_details.php b/client_document_template_details.php index f4f90bf2..b1ac6a4d 100644 --- a/client_document_template_details.php +++ b/client_document_template_details.php @@ -2,18 +2,23 @@ require_once("inc_all_client.php"); +//Initialize the HTML Purifier to prevent XSS +require("plugins/htmlpurifier/HTMLPurifier.standalone.php"); +$purifier_config = HTMLPurifier_Config::createDefault(); +$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); if (isset($_GET['document_id'])) { $document_id = intval($_GET['document_id']); } - -$sql_document = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_template = 1 AND document_id = $document_id AND documents.company_id = $session_company_id"); +$sql_document = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_template = 1 AND document_id = $document_id"); $row = mysqli_fetch_array($sql_document); $document_name = htmlentities($row['document_name']); -$document_content = $row['document_content']; +$document_content = $purifier->purify(html_entity_decode($row['document_content'])); +//$document_content = $row['document_content']; $document_created_at = htmlentities($row['document_created_at']); $document_updated_at = htmlentities($row['document_updated_at']); diff --git a/client_document_template_edit_modal.php b/client_document_template_edit_modal.php index 2ce6a87c..b5fd252c 100644 --- a/client_document_template_edit_modal.php +++ b/client_document_template_edit_modal.php @@ -16,7 +16,7 @@
- +
diff --git a/client_tickets.php b/client_tickets.php index 06846e68..eee2140a 100644 --- a/client_tickets.php +++ b/client_tickets.php @@ -82,7 +82,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $ticket_prefix = htmlentities($row['ticket_prefix']); $ticket_number = htmlentities($row['ticket_number']); $ticket_subject = htmlentities($row['ticket_subject']); - $ticket_details = $row['ticket_details']; + $ticket_details = htmlentities($row['ticket_details']); $ticket_priority = htmlentities($row['ticket_priority']); $ticket_status = htmlentities($row['ticket_status']); $ticket_created_at = htmlentities($row['ticket_created_at']); diff --git a/plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/4.15.0,4114918a13a428a8482a8a449792a5a8747582b5,1.ser b/plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/4.15.0,4114918a13a428a8482a8a449792a5a8747582b5,1.ser new file mode 100644 index 00000000..098257e1 Binary files /dev/null and b/plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/4.15.0,4114918a13a428a8482a8a449792a5a8747582b5,1.ser differ diff --git a/post.php b/post.php index df454853..d7e93f21 100644 --- a/post.php +++ b/post.php @@ -7286,6 +7286,7 @@ if(isset($_POST['add_document'])){ $client_id = intval($_POST['client_id']); $name = sanitizeInput($_POST['name']); $content = trim(mysqli_real_escape_string($mysqli,$purifier->purify(html_entity_decode($_POST['content'])))); + $content_raw = sanitizeInput($_POST['name'] . " " . str_replace("<", " <", $_POST['content'])); // Content Raw is used for FULL INDEX searching. Adding a space before HTML tags to allow spaces between newlines, bulletpoints, etc. for searching. diff --git a/ticket.php b/ticket.php index e2efb7ee..6aaac37d 100644 --- a/ticket.php +++ b/ticket.php @@ -1,6 +1,12 @@ set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); + if (isset($_GET['ticket_id'])) { $ticket_id = intval($_GET['ticket_id']); @@ -38,7 +44,8 @@ if (isset($_GET['ticket_id'])) { $ticket_number = intval($row['ticket_number']); $ticket_category = htmlentities($row['ticket_category']); $ticket_subject = htmlentities($row['ticket_subject']); - $ticket_details = $row['ticket_details']; + $ticket_details = $purifier->purify(html_entity_decode($row['ticket_details'])); + //$ticket_details = $row['ticket_details']; $ticket_priority = htmlentities($row['ticket_priority']); //Set Ticket Bage Color based of priority if ($ticket_priority == "High") { @@ -313,7 +320,8 @@ if (isset($_GET['ticket_id'])) { while ($row = mysqli_fetch_array($sql_ticket_replies)) { $ticket_reply_id = intval($row['ticket_reply_id']); - $ticket_reply = $row['ticket_reply']; + $ticket_reply = $purifier->purify(html_entity_decode($row['ticket_reply'])); + //$ticket_reply = $row['ticket_reply']; $ticket_reply_type = htmlentities($row['ticket_reply_type']); $ticket_reply_created_at = htmlentities($row['ticket_reply_created_at']); $ticket_reply_updated_at = htmlentities($row['ticket_reply_updated_at']);