Skip to content

Commit ead79db

Browse files
committed
Security: Fix XSS in session category
See advisory GHSA-p4m6-gwhg-x89f
1 parent 2054845 commit ead79db

File tree

1 file changed

+14
-3
lines changed

1 file changed

+14
-3
lines changed

main/inc/lib/sessionmanager.lib.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
/* For licensing terms, see /license.txt */
44

5+
use Chamilo\CoreBundle\Component\HTMLPurifier\Filter\RemoveOnAttributes;
56
use Chamilo\CoreBundle\Entity\Course;
67
use Chamilo\CoreBundle\Entity\ExtraField;
78
use Chamilo\CoreBundle\Entity\Repository\SequenceResourceRepository;
@@ -3066,7 +3067,10 @@ public static function create_category_session(
30663067
) {
30673068
$tbl_session_category = Database::get_main_table(TABLE_MAIN_SESSION_CATEGORY);
30683069

3069-
$name = Database::escape_string(trim($sname));
3070+
$name = trim($sname);
3071+
$name = html_filter($name);
3072+
$name = RemoveOnAttributes::filter($name);
3073+
$name = Database::escape_string($name);
30703074

30713075
$year_start = intval($syear_start);
30723076
$month_start = intval($smonth_start);
@@ -3150,7 +3154,9 @@ public static function edit_category_session(
31503154
$sday_end
31513155
) {
31523156
$tbl_session_category = Database::get_main_table(TABLE_MAIN_SESSION_CATEGORY);
3153-
$name = html_filter(trim($sname));
3157+
$name = trim($sname);
3158+
$name = html_filter($name);
3159+
$name = RemoveOnAttributes::filter($name);
31543160
$year_start = intval($syear_start);
31553161
$month_start = intval($smonth_start);
31563162
$day_start = intval($sday_start);
@@ -3463,7 +3469,12 @@ public static function get_all_session_category()
34633469
ORDER BY name ASC';
34643470
$result = Database::query($sql);
34653471
if (Database::num_rows($result) > 0) {
3466-
$data = Database::store_result($result, 'ASSOC');
3472+
$data = [];
3473+
3474+
while ($category = Database::fetch_assoc($result)) {
3475+
$category['name'] = Security::remove_XSS($category['name']);
3476+
$data[] = $category;
3477+
}
34673478

34683479
return $data;
34693480
}

0 commit comments

Comments
 (0)