From 5ed516f9dafd8ac29ec2ed112d74822b10676008 Mon Sep 17 00:00:00 2001
From: OpenXE <>
Date: Thu, 21 Sep 2023 08:30:05 +0200
Subject: [PATCH] ticket system betreff strip tags

---
 www/pages/content/ticket_edit.tpl |  2 +-
 www/pages/ticket.php              | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/www/pages/content/ticket_edit.tpl b/www/pages/content/ticket_edit.tpl
index 67076598..dbb4d36d 100644
--- a/www/pages/content/ticket_edit.tpl
+++ b/www/pages/content/ticket_edit.tpl
@@ -19,7 +19,7 @@
 	        				<fieldset>
                                 <table width="100%" border="0" class="mkTableFormular">
                                     <legend>{|[STATUSICON]<b>Ticket <font color="blue">#[SCHLUESSEL]</font></b>|}</legend>
-                                    <tr><td>{|Betreff|}:</td><td><input type="text" name="betreff" id="betreff" value="[BETREFF]" size="20"></td></tr>
+                                    <tr><td>{|Betreff|}:</td><td><input type="text" name="betreff" id="betreff" value="[BETREFF]" size="100%"></td></tr>
                                     <tr><td>{|Von|}:</td><td>[KUNDE]&nbsp;[MAILADRESSE]</td></tr>
                                     <tr><td>{|Projekt|}:</td><td><input type="text" name="projekt" id="projekt" value="[PROJEKT]" size="20"></td></tr>
                                     <tr><td>{|Adresse|}:</td><td><input type="text" name="adresse" id="adresse" value="[ADRESSE]" size="20"><a href="index.php?module=adresse&action=edit&id=[ADRESSE_ID]"><img src="./themes/new/images/forward.svg" border="0" style="top:6px; position:relative"></a></td></tr>
diff --git a/www/pages/ticket.php b/www/pages/ticket.php
index d7c0b0da..d23eeb80 100644
--- a/www/pages/ticket.php
+++ b/www/pages/ticket.php
@@ -68,7 +68,7 @@ class Ticket {
                 $dropnbox = "'<img src=./themes/new/images/details_open.png class=details>' AS `open`,
                               CONCAT('<input type=\"checkbox\" name=\"auswahl[]\" value=\"',t.id,'\" />') AS `auswahl`";
 
-                $priobetreff = "if(t.prio!=1,t.betreff,CONCAT('<b><font color=red>',t.betreff,'</font></b>'))";
+                $priobetreff = "if(t.prio!=1,REGEXP_REPLACE(t.betreff, '<[^>]*>+', ''),CONCAT('<b><font color=red>',REGEXP_REPLACE(t.betreff, '<[^>]*>+', ''),'</font></b>'))"; //+ #20230916 XSS
 
                 $anzahlnachrichten = "(SELECT COUNT(n.id) FROM ticket_nachricht n WHERE n.ticket = t.schluessel)";
 
@@ -310,6 +310,8 @@ class Ticket {
         // Add Messages now
         foreach ($messages as $message) {
 
+            $message['betreff'] = strip_tags($message['betreff']); //+ #20230916 XSS
+
             // Clear this first
             $this->app->Tpl->Set('NACHRICHT_ANHANG',"");         
 
@@ -622,6 +624,8 @@ class Ticket {
 
         $ticket_from_db = $this->app->DB->SelectArr($sql)[0];
 
+        $ticket_from_db['betreff'] = htmlentities(strip_tags($ticket_from_db['betreff'])); //+ #20230916 XSS
+
         foreach ($ticket_from_db as $key => $value) {
             $this->app->Tpl->Set(strtoupper($key), $value);   
         }
@@ -733,10 +737,10 @@ class Ticket {
                 
                 if (!empty($recv_messages)) {
                     if (!str_starts_with(strtoupper($recv_messages[0]['betreff']),"RE:")) {
-                        $betreff = "RE: ".$recv_messages[0]['betreff'];
+                        $betreff = "RE: ".strip_tags($recv_messages[0]['betreff']); //+ #20230916 XSS
                     }
                     else {
-                        $betreff = $recv_messages[0]['betreff'];
+                        $betreff = strip_tags($recv_messages[0]['betreff']); //+ #20230916 XSS
                     }
 
                     $sql = "SELECT GROUP_CONCAT(DISTINCT `value` ORDER BY `value` SEPARATOR ', ') FROM ticket_header th WHERE th.ticket_nachricht = ".$recv_messages[0]['id']." AND `value` <> '".$senderAddress."' AND type='to'";