[SECURITY] please update ASAP

Escaped inputed values before saving to Database and before using in TYPO3-Backend
frappant · Feb 21, 2023 · 890e419 · 890e419
1 parent 5b19bea
commit 890e419
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 10 deletions.
diff --git a/Classes/Domain/Finishers/SaveFormToDatabaseFinisher.php b/Classes/Domain/Finishers/SaveFormToDatabaseFinisher.php
@@ -79,10 +79,10 @@ protected function getFormValues(): array
             foreach ($page->getElementsRecursively() as $pageElem) {
                 if ($pageElem->getType() !== 'Honeypot') {
                 	if($pageElem->getType() !== 'FileUpload' && $pageElem->getType() !== 'ImageUpload'){
-		                $values[$pageElem->getIdentifier()]['value'] = $valuesWithPages[$pageElem->getIdentifier()];
+		                $values[$pageElem->getIdentifier()]['value'] = htmlspecialchars($valuesWithPages[$pageElem->getIdentifier()]);
 	                }else{
                 		if($valuesWithPages[$pageElem->getIdentifier()]){
-			                $values[$pageElem->getIdentifier()]['value'] = $valuesWithPages[$pageElem->getIdentifier()]->getOriginalResource()->getName();
+			                $values[$pageElem->getIdentifier()]['value'] = htmlspecialchars($valuesWithPages[$pageElem->getIdentifier()]->getOriginalResource()->getName());
 		                }
 	                }
                     $values[$pageElem->getIdentifier()]['conf']['label'] = $pageElem->getLabel();

diff --git a/Classes/Form/FormAnswersJsonElement.php b/Classes/Form/FormAnswersJsonElement.php
@@ -19,9 +19,9 @@ public function render()
         if (is_array($fieldValues)) {
             foreach ($fieldValues as $fieldKey => $fieldValue) {
                 if ($fieldValue['conf']['label']) {
-                    $out .= '<li>'.$fieldValue['conf']['label'].' - '.(is_array($fieldValue['value']) ? implode(",", $fieldValue['value']) : $fieldValue['value']).'</li>';
+                    $out .= '<li>'.$fieldValue['conf']['label'].' - '.(is_array($fieldValue['value']) ? implode(",", htmlspecialchars($fieldValue['value'])) : htmlspecialchars($fieldValue['value'])).'</li>';
                 } else {
-                    $out .= '<li>'.$fieldKey.' - '.(is_array($fieldValue['value']) ? implode(",", $fieldValue['value']) : $fieldValue['value']).'</li>';
+                    $out .= '<li>'.$fieldKey.' - '.(is_array($fieldValue['value']) ? implode(",", htmlspecialchars($fieldValue['value'])) : htmlspecialchars($fieldValue['value'])).'</li>';
                 }
             }
         }

diff --git a/Resources/Private/Backend/Partials/FormEntry/Properties.html b/Resources/Private/Backend/Partials/FormEntry/Properties.html
@@ -9,7 +9,7 @@
                     key="LLL:EXT:frp_form_answers/Resources/Private/Language/locallang_be.xlf:tx_frpformanswers_domain_model_formentry.answers"/>
         </td>
         <td>
-            {formEntry.answers}
+            <f:format.htmlspecialchars>{formEntry.answers}</f:format.htmlspecialchars>
         </td>
     </tr>
     <tr>
@@ -18,7 +18,7 @@
                     key="LLL:EXT:frp_form_answers/Resources/Private/Language/locallang_be.xlf:tx_frpformanswers_domain_model_formentry.field_hash"/>
         </td>
         <td>
-            {formEntry.fieldHash}
+            <f:format.htmlspecialchars>{formEntry.fieldHash}</f:format.htmlspecialchars>
         </td>
     </tr>
     <tr>
@@ -27,7 +27,7 @@
                     key="LLL:EXT:frp_form_answers/Resources/Private/Language/locallang_be.xlf:tx_frpformanswers_domain_model_formentry.form"/>
         </td>
         <td>
-            {formEntry.form}
+            <f:format.htmlspecialchars>{formEntry.form}</f:format.htmlspecialchars>
         </td>
     </tr>
     <tr>
@@ -36,7 +36,7 @@
                     key="LLL:EXT:frp_form_answers/Resources/Private/Language/locallang_be.xlf:tx_frpformanswers_domain_model_formentry.exported"/>
         </td>
         <td>
-            {formEntry.exported}
+            <f:format.htmlspecialchars>{formEntry.exported}</f:format.htmlspecialchars>
         </td>
     </tr>
 </table>
diff --git a/Resources/Private/CommandTask/Partials/FormEntries/InMail.html b/Resources/Private/CommandTask/Partials/FormEntries/InMail.html
@@ -16,8 +16,8 @@
         <f:format.date format="d.m.Y H:i">{mailItem.crdate}</f:format.date>
         <br>
         Form name: {mailItem.form}<br>
-        From: {mailItem.answers.name.value} - {mailItem.answers.email.value}<br>
-        Message: {mailItem.answers.message.value}<br>
+        From: <f:format.htmlspecialchars>{mailItem.answers.name.value} - {mailItem.answers.email.value}</f:format.htmlspecialchars><br>
+        Message: <f:format.htmlspecialchars>{mailItem.answers.message.value}</f:format.htmlspecialchars><br>
         <br>
     </f:for>