From 922b883dd666fda7fe85ebe9417e139dce927fc2 Mon Sep 17 00:00:00 2001
From: corentin-soriano <corentin+github@soriano.app>
Date: Mon, 30 Sep 2024 10:43:49 +0200
Subject: [PATCH] Fix users encoding #4316

---
 includes/core/login.js.php  | 2 +-
 pages/users.js.php          | 8 ++++----
 sources/users.datatable.php | 9 ++++-----
 sources/users.queries.php   | 4 ++--
 4 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/includes/core/login.js.php b/includes/core/login.js.php
index 4870551b8..522d5b2a1 100755
--- a/includes/core/login.js.php
+++ b/includes/core/login.js.php
@@ -31,7 +31,7 @@
 
 ?>
 <script type="text/javascript">
-    var debugJavascript = true;
+    var debugJavascript = false;
 
     // On page load
     $(function() {
diff --git a/pages/users.js.php b/pages/users.js.php
index 39d47128b..ea00b3415 100755
--- a/pages/users.js.php
+++ b/pages/users.js.php
@@ -819,10 +819,10 @@ function(data) {
 
                     if (data.error === false) {
                         // Prefil with user data
-                        $('#form-login').val(data.login);
-                        $('#form-email').val(data.email);
-                        $('#form-name').val(data.name);
-                        $('#form-lastname').val(data.lastname);
+                        $('#form-login').val($('<div>').html(data.login).text());
+                        $('#form-email').val($('<div>').html(data.email).text());
+                        $('#form-name').val($('<div>').html(data.name).text());
+                        $('#form-lastname').val($('<div>').html(data.lastname).text());
                         $('#form-create-root-folder').iCheck(data.can_create_root_folder === 1 ? 'check' : 'uncheck');
                         $('#form-create-personal-folder').iCheck(data.personal_folder === 1 ? 'check' : 'uncheck');
                         $('#form-create-mfa-enabled').iCheck(data.mfa_enabled === 1 ? 'check' : 'uncheck');
diff --git a/sources/users.datatable.php b/sources/users.datatable.php
index bcb395986..6b5a8c91e 100755
--- a/sources/users.datatable.php
+++ b/sources/users.datatable.php
@@ -275,10 +275,10 @@
                 ).
                 ((in_array($record['id'], [OTV_USER_ID, TP_USER_ID, SSH_USER_ID, API_USER_ID]) === false && (int) $record['pw_passwordlib'] === 1) ? '<i class=\"fa-solid fa-person-walking-luggage infotip ml-1\" style=\"color:Tomato\" title=\"Old password encryption. Shall login to initialize.\"></i>' : '');
         }
-        
+
         $sOutput .= '["<span data-id=\"'.$record['id'].'\" data-fullname=\"'.
-            addslashes(str_replace("'", '&lsquo;', empty($record['name']) === false ? $record['name'] : '')).' '.
-            addslashes(str_replace("'", '&lsquo;', empty($record['lastname']) === false ? $record['lastname'] : '')).
+            (empty($record['name']) === false ? htmlentities($record['name'], ENT_QUOTES|ENT_SUBSTITUTE|ENT_DISALLOWED) : '').' '.
+            (empty($record['lastname']) === false ? htmlentities($record['lastname'], ENT_QUOTES|ENT_SUBSTITUTE|ENT_DISALLOWED) : '').
             '\" data-auth-type=\"'.$record['auth_type'].'\" data-special=\"'.$record['special'].'\" data-mfa-enabled=\"'.$record['mfa_enabled'].'\" data-otp-provided=\"'.(isset($record['otp_provided']) === true ? $record['otp_provided'] : '').'\"></span>", ';
         //col2
         $sOutput .= '"'.
@@ -350,5 +350,4 @@
     $sOutput .= '[]';
 }
 
-//echo ($sOutput).'}';
-echo $antiXss->xss_clean($sOutput.'}');
+echo ($sOutput).'}';
diff --git a/sources/users.queries.php b/sources/users.queries.php
index 003cebbfa..428862bb3 100755
--- a/sources/users.queries.php
+++ b/sources/users.queries.php
@@ -1357,8 +1357,8 @@
 
                 $arrData['error'] = false;
                 $arrData['login'] = $rowUser['login'];
-                $arrData['name'] = empty($rowUser['name']) === false && $rowUser['name'] !== NULL ? htmlspecialchars_decode($rowUser['name'], ENT_QUOTES) : '';
-                $arrData['lastname'] = empty($rowUser['lastname']) === false && $rowUser['lastname'] !== NULL ? htmlspecialchars_decode($rowUser['lastname'], ENT_QUOTES) : '';
+                $arrData['name'] = empty($rowUser['name']) === false && $rowUser['name'] !== NULL ? $rowUser['name'] : '';
+                $arrData['lastname'] = empty($rowUser['lastname']) === false && $rowUser['lastname'] !== NULL ? $rowUser['lastname'] : '';
                 $arrData['email'] = $rowUser['email'];
                 $arrData['function'] = $functionsList;
                 $arrData['managedby'] = $managedBy;