← All changes | controllers/template.php +54 -17 11.7 → trunk View file →

		@@ -9,11 +9,11 @@
9	9	// import dependencies.
10	10	cssJSToolbox::import('framework:mvc:controller-ajax.inc.php');
11	11
12	12	/**
13		-*
	13	+*
14	14	* DESCRIPTION
15		-*
	15	+*
16	16	* @author ??
17	17	* @version ??
18	18	*/
19	19	class CJTTemplateController extends CJTAjaxController {
		@@ -19,24 +19,24 @@
19	19	class CJTTemplateController extends CJTAjaxController {
20	20
21	21	/**
22	22	* put your comment there...
23		- *
	23	+ *
24	24	* @var mixed
25	25	*/
26	26	protected $controllerInfo = array('model' => 'template');
27		-
	27	+
28	28	/**
29	29	* put your comment there...
30		- *
	30	+ *
31	31	* @var mixed
32	32	*/
33	33	protected $onsave = array('parameters' => array('data'));
34		-
	34	+
35	35	/**
36		- *
	36	+ *
37	37	* Initialize new object.
38		- *
	38	+ *
39	39	* @return void
40	40	*/
41	41	public function __construct() {
42	42	// Initialize parent!
		@@ -49,9 +49,9 @@
49	49	}
50	50
51	51	/**
52	52	* put your comment there...
53		- *
	53	+ *
54	54	*/
55	55	protected function editAction() {
56	56	$this->model->inputs['id'] = (int) $_REQUEST['id'];
57	57	// Display the view.
		@@ -56,12 +56,12 @@
56	56	$this->model->inputs['id'] = (int) $_REQUEST['id'];
57	57	// Display the view.
58	58	parent::displayAction();
59	59	}
60		-
	60	+
61	61	/**
62	62	* put your comment there...
63		- *
	63	+ *
64	64	*/
65	65	protected function getTemplateByAction() {
66	66	// Initialize.
67	67	$returns = array_flip($_GET['returns']);
		@@ -70,12 +70,12 @@
70	70	$inputs['filter'] = $_GET['filter'];
71	71	// Query Block.
72	72	$this->response = array_intersect_key((array) $this->model->getTemplateBy(), $returns);
73	73	}
74		-
	74	+
75	75	/**
76	76	* put your comment there...
77		- *
	77	+ *
78	78	*/
79	79	protected function infoAction() {
80	80	$this->model->inputs['id'] = (int) $_REQUEST['id'];
81	81	// Display the view.
		@@ -80,16 +80,54 @@
80	80	$this->model->inputs['id'] = (int) $_REQUEST['id'];
81	81	// Display the view.
82	82	parent::displayAction();
83	83	}
84		-
	84	+
85	85	/**
86		- * put your comment there...
87		- *
	86	+ * Save template data with proper sanitization to prevent XSS attacks.
	87	+ *
	88	+ * Security Fix: Sanitizes all user inputs (description, keywords, name, changeLog, version)
	89	+ * to prevent Stored XSS vulnerabilities. This addresses the security issue where malicious
	90	+ * scripts could be injected through template fields and executed when viewing the Templates
	91	+ * Manager page, Template Lookup feature, or when using the Embed/Link Templates functionality.
	92	+ *
	93	+ * @security CVE Reference: Stored XSS in template save endpoint
88	94	*/
89	95	protected function saveAction() {
90	96	// Read inputs
91	97	$item = filter_input(INPUT_POST, 'item', FILTER_UNSAFE_RAW, FILTER_REQUIRE_ARRAY);
	98	+
	99	+ // Sanitize template fields to prevent XSS
	100	+ if (isset($item['template'])) {
	101	+ // Sanitize description field - strip all HTML tags
	102	+ if (isset($item['template']['description'])) {
	103	+ $item['template']['description'] = sanitize_textarea_field($item['template']['description']);
	104	+ }
	105	+
	106	+ // Sanitize keywords field - strip all HTML tags
	107	+ if (isset($item['template']['keywords'])) {
	108	+ $item['template']['keywords'] = sanitize_textarea_field($item['template']['keywords']);
	109	+ }
	110	+
	111	+ // Sanitize name field
	112	+ if (isset($item['template']['name'])) {
	113	+ $item['template']['name'] = sanitize_text_field($item['template']['name']);
	114	+ }
	115	+ }
	116	+
	117	+ // Sanitize revision fields
	118	+ if (isset($item['revision'])) {
	119	+ // Sanitize changeLog field
	120	+ if (isset($item['revision']['changeLog'])) {
	121	+ $item['revision']['changeLog'] = sanitize_textarea_field($item['revision']['changeLog']);
	122	+ }
	123	+
	124	+ // Sanitize version field
	125	+ if (isset($item['revision']['version'])) {
	126	+ $item['revision']['version'] = sanitize_text_field($item['revision']['version']);
	127	+ }
	128	+ }
	129	+
92	130	// Posted template data is in the item array, the others is just for making the request!
93	131	$this->model->inputs['item'] = $this->onsave($item);
94	132	if ($revision = $this->model->save()) {
95	133	$this->response = array('revision' => $revision);
		@@ -94,9 +132,8 @@
94	132	if ($revision = $this->model->save()) {
95	133	$this->response = array('revision' => $revision);
96	134	}
97	135	}
98		-
99	136	} // End class.
100	137
101	138	// Hookable!
102	139	CJTTemplateController::define('CJTTemplateController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));