From cde00da8ba38b476495f051249de02ca3f923842 Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Sat, 27 Jun 2020 11:39:05 +0200
Subject: [PATCH] Incorrect encoding of conditions

---
 .../condition/AbstractMultiCategoryCondition.class.php       | 3 ++-
 .../system/condition/AbstractMultiSelectCondition.class.php  | 3 ++-
 .../lib/system/condition/AbstractSelectCondition.class.php   | 5 +++--
 .../files/lib/system/condition/UserGroupCondition.class.php  | 3 ++-
 wcfsetup/install/files/lib/system/io/Tar.class.php           | 2 +-
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/wcfsetup/install/files/lib/system/condition/AbstractMultiCategoryCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractMultiCategoryCondition.class.php
index 63732ff5f7..afe497fa25 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractMultiCategoryCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractMultiCategoryCondition.class.php
@@ -3,6 +3,7 @@ namespace wcf\system\condition;
 use wcf\data\category\CategoryNode;
 use wcf\data\category\CategoryNodeTree;
 use wcf\system\category\CategoryHandler;
+use wcf\util\StringUtil;
 
 /**
  * Abstract implementation of a condition for selecting multiple categories.
@@ -37,7 +38,7 @@ abstract class AbstractMultiCategoryCondition extends AbstractMultiSelectConditi
 		$fieldElement = '<select name="'.$this->fieldName.'[]" id="'.$this->fieldName.'" multiple size="'.($categoryCount >= 10 ? 10 : $categoryCount).'">';
 		/** @var CategoryNode $categoryNode */
 		foreach ($categoryTree as $categoryNode) {
-			$fieldElement .= "<option value=\"{$categoryNode->categoryID}\"".(in_array($categoryNode->categoryID, $this->fieldValue) ? ' selected' : '').">".str_repeat("&nbsp;&nbsp;&nbsp;&nbsp;", $categoryNode->getDepth() - 1).$categoryNode->getTitle()."</option>";
+			$fieldElement .= "<option value=\"{$categoryNode->categoryID}\"".(in_array($categoryNode->categoryID, $this->fieldValue) ? ' selected' : '').">".str_repeat("&nbsp;&nbsp;&nbsp;&nbsp;", $categoryNode->getDepth() - 1) . StringUtil::encodeHTML($categoryNode->getTitle()) . "</option>";
 		}
 		$fieldElement .= '</select>';
 		
diff --git a/wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php
index 90fd8df12d..afbc7629e0 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php
@@ -3,6 +3,7 @@ namespace wcf\system\condition;
 use wcf\system\exception\UserInputException;
 use wcf\system\WCF;
 use wcf\util\ArrayUtil;
+use wcf\util\StringUtil;
 
 /**
  * Abstract implementation of a condition with multi select options.
@@ -54,7 +55,7 @@ abstract class AbstractMultiSelectCondition extends AbstractSelectCondition {
 	 * @inheritDoc
 	 */
 	protected function getOptionCode($value, $label) {
-		return '<option value="'.$value.'"'.(in_array($value, $this->fieldValue) ? ' selected' : '').'>'.WCF::getLanguage()->get($label).'</option>';
+		return '<option value="'.$value.'"'.(in_array($value, $this->fieldValue) ? ' selected' : '').'>' . StringUtil::encodeHTML(WCF::getLanguage()->get($label)) . '</option>';
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
index 7a6e188090..00fa564e39 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
@@ -3,6 +3,7 @@ namespace wcf\system\condition;
 use wcf\data\condition\Condition;
 use wcf\system\exception\UserInputException;
 use wcf\system\WCF;
+use wcf\util\StringUtil;
 
 /**
  * Abstract implementation of a condition with select options.
@@ -79,7 +80,7 @@ abstract class AbstractSelectCondition extends AbstractSingleFieldCondition {
 	 * @return	string
 	 */
 	protected function getOptGroupCode($label, array $options) {
-		$html = '<optgroup label="'.$label.'">';
+		$html = '<optgroup label="' . StringUtil::encodeHTML($label) . '">';
 		foreach ($options as $key => $value) {
 			$html .= $this->getOptionCode($key, $value);
 		}
@@ -96,7 +97,7 @@ abstract class AbstractSelectCondition extends AbstractSingleFieldCondition {
 	 * @return	string
 	 */
 	protected function getOptionCode($value, $label) {
-		return '<option value="'.$value.'"'.($this->fieldValue == $value ? ' selected' : '').'>'.WCF::getLanguage()->get($label).'</option>';
+		return '<option value="'.$value.'"'.($this->fieldValue == $value ? ' selected' : '').'>' . StringUtil::encodeHTML(WCF::getLanguage()->get($label)) . '</option>';
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/system/condition/UserGroupCondition.class.php b/wcfsetup/install/files/lib/system/condition/UserGroupCondition.class.php
index 144caa73b3..b2470367e4 100644
--- a/wcfsetup/install/files/lib/system/condition/UserGroupCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/UserGroupCondition.class.php
@@ -8,6 +8,7 @@ use wcf\data\DatabaseObjectList;
 use wcf\system\exception\UserInputException;
 use wcf\system\WCF;
 use wcf\util\ArrayUtil;
+use wcf\util\StringUtil;
 
 /**
  * Condition implementation for all of the user groups a user has to be a member
@@ -147,7 +148,7 @@ HTML;
 		$returnValue = "";
 		foreach ($userGroups as $userGroup) {
 			/** @noinspection PhpVariableVariableInspection */
-			$returnValue .= "<label><input type=\"checkbox\" name=\"".$identifier."[]\" value=\"".$userGroup->groupID."\"".(in_array($userGroup->groupID, $this->$identifier) ? ' checked' : "")."> ".$userGroup->getName()."</label>";
+			$returnValue .= "<label><input type=\"checkbox\" name=\"".$identifier."[]\" value=\"".$userGroup->groupID."\"".(in_array($userGroup->groupID, $this->$identifier) ? ' checked' : "")."> " . StringUtil::encodeHTML($userGroup->getName()) . "</label>";
 		}
 		
 		return $returnValue;
diff --git a/wcfsetup/install/files/lib/system/io/Tar.class.php b/wcfsetup/install/files/lib/system/io/Tar.class.php
index ac3920b5d2..2258cd0c4c 100644
--- a/wcfsetup/install/files/lib/system/io/Tar.class.php
+++ b/wcfsetup/install/files/lib/system/io/Tar.class.php
@@ -313,7 +313,7 @@ class Tar implements IArchive {
 		$data = unpack($format, $binaryData);
 		
 		// Extract the properties
-		$header['checksum'] = @octdec(trim($data['checksum']));
+		$header['checksum'] = octdec(trim($data['checksum']));
 		if ($header['checksum'] == $checksum) {
 			$header['filename'] = trim($data['filename']);
 			$header['mode'] = octdec(trim($data['mode']));
-- 
2.20.1