XSS fixes

app/Http/Controllers/ClientPortalController.php

@@ -431,7 +431,7 @@ class ClientPortalController extends BaseController
                     return $model->invitation_key ? link_to('/view/'.$model->invitation_key, $model->invoice_number)->toHtml() : $model->invoice_number;
                 })
                 ->addColumn('transaction_reference', function ($model) {
-                    return $model->transaction_reference ? $model->transaction_reference : '<i>'.trans('texts.manual_entry').'</i>';
+                    return $model->transaction_reference ? e($model->transaction_reference) : '<i>'.trans('texts.manual_entry').'</i>';
                 })
                 ->addColumn('payment_type', function ($model) {
                     return ($model->payment_type && ! $model->last4) ? $model->payment_type : ($model->account_gateway_id ? '<i>Online payment</i>' : '');

app/Http/Controllers/TaskController.php

@@ -161,7 +161,7 @@ class TaskController extends BaseController
             $invoices = $task->client_id ? $this->invoiceRepo->findOpenInvoices($task->client_id) : [];
 
             foreach ($invoices as $invoice) {
-                $actions[] = ['url' => 'javascript:submitAction("add_to_invoice", '.$invoice->public_id.')', 'label' => trans('texts.add_to_invoice', ['invoice' => $invoice->invoice_number])];
+                $actions[] = ['url' => 'javascript:submitAction("add_to_invoice", '.$invoice->public_id.')', 'label' => trans('texts.add_to_invoice', ['invoice' => e($invoice->invoice_number)])];
             }
         }
 

app/Libraries/HTMLUtils.php

@@ -39,6 +39,8 @@ class HTMLUtils
 
     public static function sanitizeHTML($html)
     {
+        $html = html_entity_decode($html);
+
         $config = HTMLPurifier_Config::createDefault();
         $purifier = new HTMLPurifier($config);
 

app/Models/Activity.php

@@ -123,11 +123,11 @@ class Activity extends Eloquent
 
         $data = [
             'client' => $client ? link_to($client->getRoute(), $client->getDisplayName()) : null,
-            'user' => $isSystem ? '<i>' . trans('texts.system') . '</i>' : $user->getDisplayName(),
+            'user' => $isSystem ? '<i>' . trans('texts.system') . '</i>' : e($user->getDisplayName()),
             'invoice' => $invoice ? link_to($invoice->getRoute(), $invoice->getDisplayName()) : null,
             'quote' => $invoice ? link_to($invoice->getRoute(), $invoice->getDisplayName()) : null,
-            'contact' => $contactId ? $client->getDisplayName() : $user->getDisplayName(),
+            'contact' => $contactId ? e($client->getDisplayName()) : e($user->getDisplayName()),
-            'payment' => $payment ? $payment->transaction_reference : null,
+            'payment' => $payment ? e($payment->transaction_reference) : null,
             'payment_amount' => $payment ? $account->formatMoney($payment->amount, $payment) : null,
             'adjustment' => $this->adjustment ? $account->formatMoney($this->adjustment, $this) : null,
             'credit' => $credit ? $account->formatMoney($credit->amount, $client) : null,

app/Models/Traits/PresentsInvoice.php

@@ -290,7 +290,7 @@ trait PresentsInvoice
             'contact.custom_value1' => 'custom_contact_label1',
             'contact.custom_value2' => 'custom_contact_label2',
         ] as $field => $property) {
-            $data[$field] = $this->$property ?: trans('texts.custom_field');
+            $data[$field] = e($this->$property) ?: trans('texts.custom_field');
         }
 
         return $data;

app/Models/Traits/SendsEmails.php

@@ -4,6 +4,7 @@ namespace App\Models\Traits;
 
 use App\Constants\Domain;
 use Utils;
+use HTMLUtils;
 
 /**
  * Class SendsEmails.
@@ -36,7 +37,8 @@ trait SendsEmails
             $value = $this->account_email_settings->$field;
 
             if ($value) {
-                return preg_replace("/\r\n|\r|\n/", ' ', $value);
+                $value = preg_replace("/\r\n|\r|\n/", ' ', $value);
+                return HTMLUtils::sanitizeHTML($value);
             }
         }
 
@@ -94,7 +96,9 @@ trait SendsEmails
         $template = preg_replace("/\r\n|\r|\n/", ' ', $template);
 
         // <br/> is causing page breaks with the email designs
-        return str_replace('/>', ' />', $template);
+        $template = str_replace('/>', ' />', $template);
+
+        return HTMLUtils::sanitizeHTML($template);
     }
 
     /**

app/Ninja/Datatables/CreditDatatable.php

@@ -50,13 +50,13 @@ class CreditDatatable extends EntityDatatable
             [
                 'public_notes',
                 function ($model) {
-                    return $model->public_notes;
+                    return e($model->public_notes);
                 },
             ],
             [
                 'private_notes',
                 function ($model) {
-                    return $model->private_notes;
+                    return e($model->private_notes);
                 },
             ],
         ];

app/Ninja/Datatables/ExpenseDatatable.php

@@ -84,7 +84,7 @@ class ExpenseDatatable extends EntityDatatable
             [
                 'public_notes',
                 function ($model) {
-                    return $model->public_notes != null ? substr($model->public_notes, 0, 100) : '';
+                    return $model->public_notes != null ? e(substr($model->public_notes, 0, 100)) : '';
                 },
             ],
             [

app/Ninja/Datatables/PaymentDatatable.php

@@ -46,7 +46,7 @@ class PaymentDatatable extends EntityDatatable
             [
                 'transaction_reference',
                 function ($model) {
-                    return $model->transaction_reference ? $model->transaction_reference : '<i>'.trans('texts.manual_entry').'</i>';
+                    return $model->transaction_reference ? e($model->transaction_reference) : '<i>'.trans('texts.manual_entry').'</i>';
                 },
             ],
             [

app/Ninja/Datatables/ProductDatatable.php

@@ -24,7 +24,7 @@ class ProductDatatable extends EntityDatatable
             [
                 'notes',
                 function ($model) {
-                    return nl2br(Str::limit($model->notes, 100));
+                    return e(nl2br(Str::limit($model->notes, 100)));
                 },
             ],
             [

app/Ninja/Datatables/RecurringInvoiceDatatable.php

@@ -64,7 +64,7 @@ class RecurringInvoiceDatatable extends EntityDatatable
             [
                 'private_notes',
                 function ($model) {
-                    return $model->private_notes;
+                    return e($model->private_notes);
                 },
             ],
             [

app/Ninja/Datatables/TaskDatatable.php

@@ -55,7 +55,7 @@ class TaskDatatable extends EntityDatatable
             [
                 'description',
                 function ($model) {
-                    return $model->description;
+                    return e($model->description);
                 },
             ],
             [

app/Ninja/Datatables/UserDatatable.php

@@ -14,7 +14,7 @@ class UserDatatable extends EntityDatatable
             [
                 'first_name',
                 function ($model) {
-                    return $model->public_id ? link_to('users/'.$model->public_id.'/edit', $model->first_name.' '.$model->last_name)->toHtml() : ($model->first_name.' '.$model->last_name);
+                    return $model->public_id ? link_to('users/'.$model->public_id.'/edit', $model->first_name.' '.$model->last_name)->toHtml() : e($model->first_name.' '.$model->last_name);
                 },
             ],
             [

app/Ninja/Presenters/AccountPresenter.php

@@ -166,7 +166,7 @@ class AccountPresenter extends Presenter
             if ($rate->is_inclusive) {
                 $name .= ' - ' . trans('texts.inclusive');
             }
-            $options[($rate->is_inclusive ? '1 ' : '0 ') . $rate->rate . ' ' . $rate->name] = $name;
+            $options[($rate->is_inclusive ? '1 ' : '0 ') . $rate->rate . ' ' . $rate->name] = e($name);
         }
 
         return $options;

app/Ninja/Repositories/CreditRepository.php

@@ -89,7 +89,7 @@ class CreditRepository extends BaseRepository
                 return Utils::formatMoney($model->balance, $model->currency_id, $model->country_id);
             })
             ->addColumn('public_notes', function ($model) {
-                return $model->public_notes;
+                return e($model->public_notes);
             })
             ->make();
 

resources/views/accounts/product.blade.php

@@ -24,10 +24,10 @@
 
   @if ($account->hasFeature(FEATURE_INVOICE_SETTINGS))
       @if ($account->custom_invoice_item_label1)
-          {!! Former::text('custom_value1')->label($account->custom_invoice_item_label1) !!}
+          {!! Former::text('custom_value1')->label(e($account->custom_invoice_item_label1)) !!}
       @endif
       @if ($account->custom_invoice_item_label2)
-          {!! Former::text('custom_value2')->label($account->custom_invoice_item_label2) !!}
+          {!! Former::text('custom_value2')->label(e($account->custom_invoice_item_label2)) !!}
       @endif
   @endif
 

resources/views/clients/edit.blade.php

@@ -50,10 +50,10 @@
 
 			@if (Auth::user()->hasFeature(FEATURE_INVOICE_SETTINGS))
 				@if ($customLabel1)
-					{!! Former::text('custom_value1')->label($customLabel1) !!}
+					{!! Former::text('custom_value1')->label(e($customLabel1)) !!}
 				@endif
 				@if ($customLabel2)
-					{!! Former::text('custom_value2')->label($customLabel2) !!}
+					{!! Former::text('custom_value2')->label(e($customLabel2)) !!}
 				@endif
 			@endif
 
@@ -115,12 +115,12 @@
 					@if ($account->custom_contact_label1)
 						{!! Former::text('custom_contact1')->data_bind("value: custom_value1, valueUpdate: 'afterkeydown',
 								attr: {name: 'contacts[' + \$index() + '][custom_value1]'}")
-							->label($account->custom_contact_label1) !!}
+							->label(e($account->custom_contact_label1)) !!}
 					@endif
 					@if ($account->custom_contact_label2)
 						{!! Former::text('custom_contact2')->data_bind("value: custom_value2, valueUpdate: 'afterkeydown',
 								attr: {name: 'contacts[' + \$index() + '][custom_value2]'}")
-							->label($account->custom_contact_label2) !!}
+							->label(e($account->custom_contact_label2)) !!}
 					@endif
 				@endif
 

resources/views/invoices/edit.blade.php

@@ -135,7 +135,14 @@
 						<label class="checkbox" data-bind="attr: {for: $index() + '_check'}, visible: email.display" onclick="refreshPDF(true)">
                             <input type="hidden" value="0" data-bind="attr: {name: 'client[contacts][' + $index() + '][send_invoice]'}">
 							<input type="checkbox" value="1" data-bind="visible: email() || first_name() || last_name(), checked: send_invoice, attr: {id: $index() + '_check', name: 'client[contacts][' + $index() + '][send_invoice]'}">
-							<span data-bind="html: email.display"></span>
+							<span data-bind="visible: first_name || last_name">
+								<span data-bind="text: first_name() + ' ' + last_name()"></span>
+								<br/>
+							</span>
+							<span data-bind="visible: email">
+								<span data-bind="text: email"></span>
+								<br/>
+							</span>
                         </label>
                         @if ( ! $invoice->is_deleted && ! $invoice->client->is_deleted)
                         <span data-bind="visible: !$root.invoice().is_recurring()">
@@ -181,7 +188,7 @@
             @endif
 
             @if ($account->showCustomField('custom_invoice_text_label1', $invoice))
-                {!! Former::text('custom_text_value1')->label($account->custom_invoice_text_label1 ?: ' ')->data_bind("value: custom_text_value1, valueUpdate: 'afterkeydown'") !!}
+                {!! Former::text('custom_text_value1')->label(e($account->custom_invoice_text_label1) ?: ' ')->data_bind("value: custom_text_value1, valueUpdate: 'afterkeydown'") !!}
             @endif
 		</div>
 
@@ -226,7 +233,7 @@
 			) !!}
 
             @if ($account->showCustomField('custom_invoice_text_label2', $invoice))
-                {!! Former::text('custom_text_value2')->label($account->custom_invoice_text_label2 ?: ' ')->data_bind("value: custom_text_value2, valueUpdate: 'afterkeydown'") !!}
+                {!! Former::text('custom_text_value2')->label(e($account->custom_invoice_text_label2) ?: ' ')->data_bind("value: custom_text_value2, valueUpdate: 'afterkeydown'") !!}
             @endif
 
             @if ($entityType == ENTITY_INVOICE)
@@ -591,12 +598,12 @@
                 @if (Auth::user()->hasFeature(FEATURE_INVOICE_SETTINGS))
                     @if ($account->custom_client_label1)
                         {!! Former::text('client[custom_value1]')
-                            ->label($account->custom_client_label1)
+                            ->label(e($account->custom_client_label1))
                             ->data_bind("value: custom_value1, valueUpdate: 'afterkeydown'") !!}
                     @endif
                     @if ($account->custom_client_label2)
                         {!! Former::text('client[custom_value2]')
-                            ->label($account->custom_client_label2)
+                            ->label(e($account->custom_client_label2))
                             ->data_bind("value: custom_value2, valueUpdate: 'afterkeydown'") !!}
                     @endif
                 @endif
@@ -651,12 +658,12 @@
 	                    @if ($account->custom_contact_label1)
 	                        {!! Former::text('custom_contact1')->data_bind("value: custom_value1, valueUpdate: 'afterkeydown',
 		                            attr: {name: 'client[contacts][' + \$index() + '][custom_value1]'}")
-	                            ->label($account->custom_contact_label1) !!}
+	                            ->label(e($account->custom_contact_label1)) !!}
 	                    @endif
 	                    @if ($account->custom_contact_label2)
 							{!! Former::text('custom_contact2')->data_bind("value: custom_value2, valueUpdate: 'afterkeydown',
 									attr: {name: 'client[contacts][' + \$index() + '][custom_value2]'}")
-								->label($account->custom_contact_label2) !!}
+								->label(e($account->custom_contact_label2)) !!}
 	                    @endif
 	                @endif
                     <div class="form-group">