Form text fields filtering issue

Question

I am checking website for XSS and Cross Site scripting issues and i found that in account form fields or user registration page form fields for First name and Last name A user can enter html/js code. For testing when i place the following JS code :

<script>alert("Here")</script>

It is saved and is run on page load. This is very strange, because i checked the template files and values are escaped as below:

<?php echo $this->escapeHtml($this->getObject()->getFirstname()) ?>

I have also confirmed if i am in correct template file by changing the label of field. I have read the following questions and tried to used them but did not worked for me.

How to escape output data?

Is there a generic way I can apply input filtering to Magento form processing?

Regarding to the observer method, it works, but when i try to login to magento admin, i cant, but when iremove the observer, i can login again.

Update: Check the two attached screenshots.

Kindly help me with this issue.

Thank you

Answer 1

Following the Anton Evers answer ( Is there a generic way I can apply input filtering to Magento form processing? ), i have created an observer. But the problem was that the sanitizeParams method can only process post data which is in single dimension array. For login forms at admin and front end, the form fields for user name and password are in array format like below:

<input type="text" id="username" name="login[username]" value="" class="required-entry input-text">

<input type="password" id="login" name="login[password]" class="required-entry input-text" value="">

TO fix this issue, i have modified the code in observer as below:

 public function sanitizeParams($observer)
{
    if(!Mage::app()->getStore()->isAdmin())
    {
        $post = Mage::app()->getRequest()->getParams();
        foreach($post as $pkey => $pvalue)
        {
            if(is_array($post[$pkey]))
            {
                foreach($post[$pkey] as $key => $value)
                {
                    $post[$pkey][$key] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
                }
            }
            else
            {
                $post[$pkey] = filter_var($pvalue, FILTER_SANITIZE_SPECIAL_CHARS);
            }
        }

        $_POST = $post;
    }
}

And it fixed my problem, and is working fine now.

Thanks.