From 4a587707b0b88954eaf4a607bb1a908279c6072c Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <angelfqc.18@gmail.com>
Date: Mon, 17 Apr 2023 13:38:33 -0500
Subject: [PATCH] Add html filter to form fields

---
 main/admin/configure_homepage.php             | 48 ++++++++++++++-----
 main/admin/resource_sequence.php              |  8 +++-
 main/admin/system_announcements.php           |  1 +
 main/forum/forumfunction.inc.php              |  4 ++
 main/inc/lib/extra_field.lib.php              |  6 +++
 .../lib/formvalidator/FormValidator.class.php |  1 +
 main/mySpace/access_details.php               |  4 +-
 main/notebook/index.php                       |  2 +
 .../notebookteacher/src/NotebookTeacher.php   |  1 +
 9 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/main/admin/configure_homepage.php b/main/admin/configure_homepage.php
index fd6257aebd..4e95d7c287 100755
--- a/main/admin/configure_homepage.php
+++ b/main/admin/configure_homepage.php
@@ -7,6 +7,8 @@
  * @package chamilo.admin
  */
 
+use Symfony\Component\HttpFoundation\Request as HttpRequest;
+
 /**
  * Creates menu tabs for logged and anonymous users.
  *
@@ -58,6 +60,8 @@ $this_page = '';
 
 api_protect_admin_script();
 
+$httpRequest = HttpRequest::createFromGlobals();
+
 $htmlHeadXtra[] = '<script>
 $(function() {
     $("#all_langs").change(function() {
@@ -382,14 +386,14 @@ if (!empty($action)) {
             case 'edit_tabs':
             case 'insert_link':
             case 'edit_link':
-                $link_index = (isset($_POST['link_index']) ? intval($_POST['link_index']) : 0);
-                $insert_where = (isset($_POST['insert_where']) ? intval($_POST['insert_where']) : 0);
-                $link_name = trim(stripslashes($_POST['link_name']));
-                $link_url = trim(stripslashes($_POST['link_url']));
-                $add_in_tab = (isset($_POST['add_in_tab']) ? intval($_POST['add_in_tab']) : 0);
-                $link_html = trim(stripslashes($_POST['link_html']));
-                $filename = trim(stripslashes($_POST['filename']));
-                $target_blank = isset($_POST['target_blank']);
+                $link_index = $httpRequest->request->getInt('link_index');
+                $insert_where = $httpRequest->request->getInt('insert_where');
+                $link_name = Security::remove_XSS($httpRequest->request->get('link_name'));
+                $link_url = Security::remove_XSS($_POST['link_url']);
+                $add_in_tab = $httpRequest->request->getInt('add_in_tab');
+                $link_html = Security::remove_XSS($_POST['link_html']);
+                $filename = Security::remove_XSS($_POST['filename']);
+                $target_blank = $httpRequest->request->has('target_blank');
 
                 if ($link_url == 'http://' || $link_url == 'https://') {
                     $link_url = '';
@@ -895,12 +899,14 @@ switch ($action) {
         $form->addElement('hidden', 'filename', ($action == 'edit_link' || $action == 'edit_tabs') ? (!empty($filename) ? $filename : '') : '');
 
         $form->addElement('text', 'link_name', get_lang('LinkName'), ['size' => '30', 'maxlength' => '50']);
+        $form->applyFilter('text', 'html_filter');
         if (!empty($link_name)) {
             $default['link_name'] = $link_name;
         }
         $default['link_url'] = empty($link_url) ? 'http://' : api_htmlentities($link_url, ENT_QUOTES);
         $linkUrlComment = ($action == 'insert_tabs') ? get_lang('Optional').'<br />'.get_lang('GlobalLinkUseDoubleColumnPrivateToShowPrivately') : '';
         $form->addElement('text', 'link_url', [get_lang('LinkURL'), $linkUrlComment], ['size' => '30', 'maxlength' => '100', 'style' => 'width: 350px;']);
+        $form->applyFilter('link_url', 'html_filter');
 
         $options = ['-1' => get_lang('FirstPlace')];
 
@@ -1139,12 +1145,32 @@ switch ($action) {
                                             $home_menu = explode("\n", $home_menu);
                                         }
                                         $i = 0;
+
+                                        $editIcon = Display::return_icon('edit.png', get_lang('Edit'));
+                                        $deleteIcon = Display::return_icon('delete.png', get_lang('Delete'));
+
                                         foreach ($home_menu as $enreg) {
                                             $enreg = trim($enreg);
                                             if (!empty($enreg)) {
-                                                $edit_link = '<a href="'.$selfUrl.'?action=edit_link&amp;link_index='.$i.'">'.Display::return_icon('edit.png', get_lang('Edit')).'</a>';
-                                                $delete_link = '<a href="'.$selfUrl.'?action=delete_link&amp;link_index='.$i.'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;">'.Display::return_icon('delete.png', get_lang('Delete')).'</a>';
-                                                echo str_replace(['href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'], ['href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename($selfUrl).'?action=open_link&link=', $edit_link.' '.$delete_link.'</li>'], $enreg);
+                                                $edit_link = Display::url(
+                                                    $editIcon,
+                                                    "$selfUrl?".http_build_query(['action' => 'edit_link', 'link_index' => $i])
+                                                );
+                                                $delete_link = Display::url(
+                                                    $deleteIcon,
+                                                    "$selfUrl?".http_build_query(['action' => 'delete_link', 'link_index' => $i]),
+                                                    [
+                                                        'onclick' => 'javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;',
+                                                    ]
+                                                );
+                                                echo str_replace(
+                                                    ['href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'],
+                                                    [
+                                                        'href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename($selfUrl).'?action=open_link&link=',
+                                                        $edit_link.PHP_EOL.$delete_link.PHP_EOL.'</li>'
+                                                    ],
+                                                    $enreg
+                                                );
                                                 $i++;
                                             }
                                         }
diff --git a/main/admin/resource_sequence.php b/main/admin/resource_sequence.php
index 12c99493b8..eab0f9e912 100644
--- a/main/admin/resource_sequence.php
+++ b/main/admin/resource_sequence.php
@@ -5,6 +5,7 @@
 use Chamilo\CoreBundle\Entity\Sequence;
 use Chamilo\CoreBundle\Entity\SequenceResource;
 use ChamiloSession as Session;
+use Symfony\Component\HttpFoundation\Request as HttpRequest;
 
 $cidReset = true;
 
@@ -14,10 +15,14 @@ api_protect_global_admin_script();
 
 Session::erase('sr_vertex');
 
+$httpRequest = HttpRequest::createFromGlobals();
+
 // setting breadcrumbs
 $interbreadcrumb[] = ['url' => 'index.php', 'name' => get_lang('PlatformAdmin')];
 
-$type = isset($_REQUEST['type']) ? (int) $_REQUEST['type'] : SequenceResource::SESSION_TYPE;
+$type = $httpRequest->query->has('type')
+    ? $httpRequest->query->getInt('type', SequenceResource::SESSION_TYPE)
+    : $httpRequest->request->getInt('type', SequenceResource::SESSION_TYPE);
 
 $tpl = new Template(get_lang('ResourcesSequencing'));
 $em = Database::getManager();
@@ -27,6 +32,7 @@ $currentUrl = api_get_self().'?type='.$type;
 
 $formSequence = new FormValidator('sequence_form', 'post', $currentUrl, null, null, FormValidator::LAYOUT_INLINE);
 $formSequence->addText('name', get_lang('Sequence'), true, ['cols-size' => [3, 8, 1]]);
+$formSequence->applyFilter('name', 'html_filter');
 $formSequence->addButtonCreate(get_lang('AddSequence'), 'submit_sequence', false, ['cols-size' => [3, 8, 1]]);
 
 $em = Database::getManager();
diff --git a/main/admin/system_announcements.php b/main/admin/system_announcements.php
index cfb86dc284..f5f478d806 100755
--- a/main/admin/system_announcements.php
+++ b/main/admin/system_announcements.php
@@ -185,6 +185,7 @@ if ($action_todo) {
 
     $form->addHeader($form_title);
     $form->addText('title', get_lang('Title'), true);
+    $form->applyFilter('title', 'html_filter');
 
     $extraOption = [];
     $extraOption['all'] = get_lang('All');
diff --git a/main/forum/forumfunction.inc.php b/main/forum/forumfunction.inc.php
index 73e958417d..ed9dde288b 100755
--- a/main/forum/forumfunction.inc.php
+++ b/main/forum/forumfunction.inc.php
@@ -201,6 +201,7 @@ function show_add_forumcategory_form($lp_id)
     // Setting the form elements.
     $form->addElement('header', get_lang('AddForumCategory'));
     $form->addElement('text', 'forum_category_title', get_lang('Title'), ['autofocus']);
+    $form->applyFilter('forum_category_title', 'html_filter');
     $form->addElement(
         'html_editor',
         'forum_category_comment',
@@ -279,6 +280,7 @@ function show_add_forum_form($inputvalues = [], $lp_id = 0)
 
     // The title of the forum
     $form->addElement('text', 'forum_title', get_lang('Title'), ['autofocus']);
+    $form->applyFilter('forum_title', 'html_filter');
 
     // The comment of the forum.
     $form->addElement(
@@ -529,6 +531,7 @@ function show_edit_forumcategory_form($inputvalues = [])
     $form->addElement('header', '', get_lang('EditForumCategory'));
     $form->addElement('hidden', 'forum_category_id');
     $form->addElement('text', 'forum_category_title', get_lang('Title'));
+    $form->applyFilter('forum_category_title', 'html_filter');
 
     $form->addElement(
         'html_editor',
@@ -3197,6 +3200,7 @@ function show_add_post_form($current_forum, $action, $form_values = [], $showPre
     }
 
     $form->addElement('text', 'post_title', get_lang('Title'));
+    $form->applyFilter('post_title', 'post_filter');
     $form->addHtmlEditor(
         'post_text',
         get_lang('Text'),
diff --git a/main/inc/lib/extra_field.lib.php b/main/inc/lib/extra_field.lib.php
index 4d9ab35368..6371239298 100755
--- a/main/inc/lib/extra_field.lib.php
+++ b/main/inc/lib/extra_field.lib.php
@@ -1098,6 +1098,10 @@ class ExtraField extends Model
                             'extra_'.$field_details['variable'],
                             'trim'
                         );
+                        $form->applyFilter(
+                            'extra_'.$field_details['variable'],
+                            'html_filter'
+                        );
                         if ($freezeElement) {
                             $form->freeze('extra_'.$field_details['variable']);
                         }
@@ -1523,6 +1527,7 @@ class ExtraField extends Model
                         );
                         $form->applyFilter('extra_'.$field_details['variable'], 'stripslashes');
                         $form->applyFilter('extra_'.$field_details['variable'], 'trim');
+                        $form->applyFilter('extra_'.$field_details['variable'], 'html_filter');
                         if ($freezeElement) {
                             $form->freeze('extra_'.$field_details['variable']);
                         }
@@ -1537,6 +1542,7 @@ class ExtraField extends Model
                         $form->applyFilter('extra_'.$field_details['variable'], 'stripslashes');
                         $form->applyFilter('extra_'.$field_details['variable'], 'trim');
                         $form->applyFilter('extra_'.$field_details['variable'], 'mobile_phone_number_filter');
+                        $form->applyFilter('extra_'.$field_details['variable'], 'html_filter');
                         $form->addRule(
                             'extra_'.$field_details['variable'],
                             get_lang('MobilePhoneNumberWrong'),
diff --git a/main/inc/lib/formvalidator/FormValidator.class.php b/main/inc/lib/formvalidator/FormValidator.class.php
index cc6be20456..c790985615 100755
--- a/main/inc/lib/formvalidator/FormValidator.class.php
+++ b/main/inc/lib/formvalidator/FormValidator.class.php
@@ -216,6 +216,7 @@ EOT;
         }
 
         $this->applyFilter($name, 'trim');
+        $this->applyFilter($name, 'html_filter');
         if ($required) {
             $this->addRule($name, get_lang('ThisFieldIsRequired'), 'required');
         }
diff --git a/main/mySpace/access_details.php b/main/mySpace/access_details.php
index 7bf2943f7c..e51213c507 100755
--- a/main/mySpace/access_details.php
+++ b/main/mySpace/access_details.php
@@ -54,7 +54,9 @@ $form->addElement(
     ['id' => 'type']
 );
 $form->addElement('hidden', 'student', $user_id);
+$form->applyFilter('student', 'html_filter');
 $form->addElement('hidden', 'course', $course_code);
+$form->applyFilter('course', 'html_filter');
 $form->addRule('from', get_lang('ThisFieldIsRequired'), 'required');
 $form->addRule('to', get_lang('ThisFieldIsRequired'), 'required');
 $group = [
@@ -73,7 +75,7 @@ $from = null;
 $to = null;
 $course = $course_code;
 if ($form->validate()) {
-    $values = $form->getSubmitValues();
+    $values = $form->exportValues();
     $from = $values['from'];
     $to = $values['to'];
     $type = $values['type'];
diff --git a/main/notebook/index.php b/main/notebook/index.php
index 9abde2c315..0255ac3668 100755
--- a/main/notebook/index.php
+++ b/main/notebook/index.php
@@ -89,6 +89,7 @@ if ($action === 'addnote') {
     // Setting the form elements
     $form->addElement('header', '', get_lang('NoteAddNew'));
     $form->addElement('text', 'note_title', get_lang('NoteTitle'), ['id' => 'note_title']);
+    $form->applyFilter('text', 'html_filter');
     $form->addElement(
         'html_editor',
         'note_comment',
@@ -146,6 +147,7 @@ if ($action === 'addnote') {
     $form->addElement('header', '', get_lang('ModifyNote'));
     $form->addElement('hidden', 'notebook_id');
     $form->addElement('text', 'note_title', get_lang('NoteTitle'), ['size' => '100']);
+    $form->applyFilter('text', 'html_filter');
     $form->addElement(
         'html_editor',
         'note_comment',
diff --git a/plugin/notebookteacher/src/NotebookTeacher.php b/plugin/notebookteacher/src/NotebookTeacher.php
index 664c927657..3defc4fbd2 100644
--- a/plugin/notebookteacher/src/NotebookTeacher.php
+++ b/plugin/notebookteacher/src/NotebookTeacher.php
@@ -511,6 +511,7 @@ class NotebookTeacher
         );
 
         $form->addElement('text', 'note_title', get_lang('NoteTitle'), ['id' => 'note_title']);
+        $form->applyFilter('text', 'html_filter');
         $form->addElement(
             'html_editor',
             'note_comment',