Merge pull request philippK-de#120 from mdwheele/security/userprofile…

…-xss

Mitigate XSS attack on user profile page

include/initfunctions.php

@@ -207,6 +207,14 @@ function getArrayVal(array $array, $name)
     }
 }
 
+function purify($dirty)
+{
+    $config = HTMLPurifier_Config::createDefault();
+    $config->set('Cache.SerializerPath', CL_ROOT . "/files/standard/ics");
+    $purifier = new HTMLPurifier($config);
+    return $purifier->purify($dirty);
+}
+
 function cleanArray(array $theArray)
 {
     $outArray = array();

manageuser.php

@@ -208,6 +208,11 @@
     $template->assign("title", $title);
     $template->assign("user", $profile);
 
+    // This is done specifically to address an XSS vulnerability
+    // caused by rendering two user inputs on same line in HTML.
+    // They must be escaped together and rendered as one.
+    $template->assign("zipcity", purify(implode(' ', [$profile['zip'], $profile['adress2']])));
+
     $template->display("userprofile.tpl");
 } elseif ($action == "showproject") {
     if (!chkproject($userid, $id)) {

templates/standard/userprofile.tpl

@@ -103,7 +103,7 @@
                                             <tbody class="color-b">
                                             <tr>
                                                 <td><strong>{#zip#} / {#city#}:</strong></td>
-                                                <td class="right">{$user.zip}{if $user.zip && $user.adress2} {/if}{$user.adress2} </td>
+                                                <td class="right">{$zipcity} </td>
                                             </tr>
                                             </tbody>