Cross-site scripting #509

grandnode · Oct 4, 2024 · 76d56a4 · 76d56a4
1 parent a03bef8
commit 76d56a4
Show file tree

Hide file tree

Showing 82 changed files with 214 additions and 206 deletions.
diff --git a/...Plugins/Authentication.Google/Views/Shared/Components/GoogleAuthentication/Default.cshtml b/...Plugins/Authentication.Google/Views/Shared/Components/GoogleAuthentication/Default.cshtml
@@ -4,6 +4,6 @@
 <link rel="stylesheet" type="text/css" asp-src="/Plugins/Authentication.Google/Assets/googlestyles.css"/>
 <div class="google-login-block">
     <div class="buttons">
-        <a asp-controller="GoogleAuthentication" asp-action="GoogleLogin" asp-route-returnurl="@Context.Request.Query["ReturnUrl"]" class="google-btn"></a>
+        <a asp-controller="GoogleAuthentication" asp-action="GoogleLogin" asp-route-returnurl="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ReturnUrl"])" class="google-btn"></a>
     </div>
 </div>
diff --git a/src/Plugins/Authentication.Google/Views/_ViewImports.cshtml b/src/Plugins/Authentication.Google/Views/_ViewImports.cshtml
@@ -4,6 +4,7 @@
 
 @using Microsoft.AspNetCore.Mvc.ViewFeatures
 @using Grand.Infrastructure.Extensions
+@using Grand.Web.Common.Extensions
 @using Grand.Web.Common.Localization
 
 @inject LocService Loc
diff --git a/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/ShippingByWeight/AddPopup.cshtml b/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/ShippingByWeight/AddPopup.cshtml
@@ -3,9 +3,9 @@
 }
 @model Shipping.ByWeight.Models.ShippingByWeightModel
 <form id="AddPopup" asp-controller="ShippingByWeight" asp-action="AddPopup" method="post"
-      asp-route-ShippingByWeightId="@Context.Request.Query["ShippingByWeightId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-ShippingByWeightId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ShippingByWeightId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/ShippingByWeight/EditPopup.cshtml b/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/ShippingByWeight/EditPopup.cshtml
@@ -3,9 +3,9 @@
 }
 @model Shipping.ByWeight.Models.ShippingByWeightModel
 <form id="EditPopup" asp-controller="ShippingByWeight" asp-action="EditPopup" method="post"
-      asp-route-ShippingByWeightId="@Context.Request.Query["ShippingByWeightId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-ShippingByWeightId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ShippingByWeightId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/_ViewImports.cshtml b/src/Plugins/Shipping.ByWeight/Areas/Admin/Views/_ViewImports.cshtml
@@ -5,6 +5,7 @@
 @using Microsoft.AspNetCore.Mvc.ViewFeatures
 @using Grand.Infrastructure.Extensions
 @using Grand.Web.Common
+@using Grand.Web.Common.Extensions
 @using Grand.Web.Common.Localization
 
 @inject LocService Loc
diff --git a/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/ShippingPoint/Create.cshtml b/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/ShippingPoint/Create.cshtml
@@ -4,9 +4,9 @@
 @model Shipping.ShippingPoint.Models.ShippingPointModel
 
 <form id="CreatePopup" asp-controller="ShippingPoint" asp-action="Create" method="post"
-      asp-route-ShippingPointId="@Context.Request.Query["ShippingPointId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-ShippingPointId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ShippingPointId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/ShippingPoint/Edit.cshtml b/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/ShippingPoint/Edit.cshtml
@@ -4,9 +4,9 @@
 @model Shipping.ShippingPoint.Models.ShippingPointModel
 
 <form id="EditPopup" asp-controller="ShippingPoint" asp-action="Edit" method="post"
-      asp-route-ShippingPointId="@Context.Request.Query["ShippingPointId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-ShippingPointId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ShippingPointId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/_ViewImports.cshtml b/src/Plugins/Shipping.ShippingPoint/Areas/Admin/Views/_ViewImports.cshtml
@@ -5,5 +5,6 @@
 @using Microsoft.AspNetCore.Mvc.ViewFeatures
 @using Grand.Infrastructure.Extensions
 @using Grand.Web.Common
+@using Grand.Web.Common.Extensions
 @using Grand.Web.Common.Localization
 @inject LocService Loc
diff --git a/src/Plugins/Theme.Modern/Views/Modern/Account/Login.cshtml b/src/Plugins/Theme.Modern/Views/Modern/Account/Login.cshtml
@@ -18,7 +18,7 @@
             @* login main block *@
             <div class="col-12 mx-lg-0 mx-auto mt-3">
                 <validation-observer v-slot="{ handleSubmit }">
-                    <form asp-route="Login" asp-route-returnurl="@Context.Request.Query["ReturnUrl"]" ref="form" v-on:submit.prevent="handleSubmit(formSubmit)" method="post">
+                    <form asp-route="Login" asp-route-returnurl="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ReturnUrl"])" ref="form" v-on:submit.prevent="handleSubmit(formSubmit)" method="post">
                         <div class="card">
                             <div class="card-header">
                                 <h3 class="h5 mb-0 text-center">

diff --git a/src/Plugins/Theme.Modern/Views/Modern/Account/Register.cshtml b/src/Plugins/Theme.Modern/Views/Modern/Account/Register.cshtml
@@ -65,7 +65,7 @@
 </script>
 
 <validation-observer v-slot="{ handleSubmit }">
-<form asp-route="Register" asp-route-returnurl="@Context.Request.Query["ReturnUrl"]" method="post" ref="form" v-on:submit.prevent="handleSubmit(formSubmit)">
+<form asp-route="Register" asp-route-returnurl="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["ReturnUrl"])" method="post" ref="form" v-on:submit.prevent="handleSubmit(formSubmit)">
 <div class="page registration-page">
 <div asp-validation-summary="All" class="message-error"></div>
 <div class="card my-3">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/AddressAttribute/ValueCreatePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/AddressAttribute/ValueCreatePopup.cshtml
@@ -4,7 +4,7 @@
     ViewBag.Title = Loc["Admin.Address.AddressAttributes.Values.AddNew"];
 }
 <form id="ValueCreatePopup" asp-area="@Constants.AreaAdmin" asp-controller="AddressAttribute" asp-action="ValueCreatePopup"
-      asp-route-addressAttributeId="@Context.Request.Query["addressAttributeId"]">
+      asp-route-addressAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["addressAttributeId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Blog/BlogPostAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Blog/BlogPostAddPopup.cshtml
@@ -7,9 +7,9 @@
     ViewBag.Title = Loc["Admin.Content.Blog.BlogCategory.AddNewPost"];
 }
 <form id="BlogPostAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Blog" asp-action="BlogPostAddPopup" method="post"
-      asp-route-CategoryId="@Context.Request.Query["CategoryId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-CategoryId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CategoryId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Blog/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Blog/ProductAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Blog" asp-action="ProductAddPopup" method="post"
-      asp-route-BlogPostId="@Context.Request.Query["BlogPostId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-BlogPostId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["BlogPostId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Category/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Category/ProductAddPopup.cshtml
@@ -7,9 +7,9 @@
     ViewBag.Title = Loc["Admin.Catalog.Categories.Products.AddNew"];
 }
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Category" asp-action="ProductAddPopup" method="post"
-      asp-route-CategoryId="@Context.Request.Query["CategoryId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-CategoryId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CategoryId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CheckoutAttribute/ValueCreatePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CheckoutAttribute/ValueCreatePopup.cshtml
@@ -5,7 +5,7 @@
 @model CheckoutAttributeValueModel
 
 <form id="ValueCreatePopup" asp-area="@Constants.AreaAdmin" asp-controller="CheckoutAttribute" asp-action="ValueCreatePopup"
-      asp-route-checkoutAttributeId="@Context.Request.Query["checkoutAttributeId"]">
+      asp-route-checkoutAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["checkoutAttributeId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CheckoutAttribute/ValueEditPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CheckoutAttribute/ValueEditPopup.cshtml
@@ -3,7 +3,7 @@
     Layout = "";
 }
 <form id="ValueEditPopup" asp-area="@Constants.AreaAdmin" asp-controller="CheckoutAttribute" asp-action="ValueEditPopup"
-      asp-route-checkoutAttributeId="@Context.Request.Query["checkoutAttributeId"]">
+      asp-route-checkoutAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["checkoutAttributeId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Collection/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Collection/ProductAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Collection" asp-action="ProductAddPopup" method="post"
-      asp-route-CollectionId="@Context.Request.Query["CollectionId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-CollectionId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CollectionId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/ContactAttribute/ValueCreatePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/ContactAttribute/ValueCreatePopup.cshtml
@@ -4,7 +4,7 @@
 
 @model ContactAttributeValueModel
 <form id="ValueCreatePopup" asp-area="@Constants.AreaAdmin" asp-controller="ContactAttribute" asp-action="ValueCreatePopup"
-      asp-route-contactAttributeId="@Context.Request.Query["contactAttributeId"]">
+      asp-route-contactAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["contactAttributeId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/ContactAttribute/ValueEditPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/ContactAttribute/ValueEditPopup.cshtml
@@ -3,7 +3,7 @@
     Layout = "";
 }
 <form id="ValueEditPopup" asp-area="@Constants.AreaAdmin" asp-controller="ContactAttribute" asp-action="ValueEditPopup"
-      asp-route-contactAttributeId="@Context.Request.Query["contactAttributeId"]">
+      asp-route-contactAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["contactAttributeId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Country/StateCreatePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Country/StateCreatePopup.cshtml
@@ -3,7 +3,7 @@
     Layout = "";
 }
 <form id="StateCreatePopup" asp-area="@Constants.AreaAdmin" asp-controller="Country" asp-action="StateCreatePopup"
-      asp-route-countryId="@Context.Request.Query["countryId"]">
+      asp-route-countryId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["countryId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Country/StateEditPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Country/StateEditPopup.cshtml
@@ -3,7 +3,7 @@
     Layout = "";
 }
 <form id="StateEditPopup" asp-area="@Constants.AreaAdmin" asp-controller="Country" asp-action="StateEditPopup"
-      asp-route-countryId="@Context.Request.Query["countryId"]">
+      asp-route-countryId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["countryId"])">
     <div class="row">
         <div class="col-md-12">
             <div class="x_panel light form-fit">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Course/AssociateProductToCoursePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Course/AssociateProductToCoursePopup.cshtml
@@ -7,10 +7,10 @@
 }
 
 <form asp-area="@Constants.AreaAdmin" asp-controller="Course" asp-action="AssociateProductToCoursePopup" method="post"
-      asp-route-CustomerGroupId="@Context.Request.Query["CourseId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-productIdInput="@Context.Request.Query["productIdInput"]"
-      asp-route-productNameInput="@Context.Request.Query["productNameInput"]"
+      asp-route-CustomerGroupId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CourseId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-productIdInput="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["productIdInput"])"
+      asp-route-productNameInput="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["productNameInput"])"
       id="associateproduct">
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/ProductAddPopup.cshtml
@@ -7,10 +7,10 @@
 }
 
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Customer" asp-action="ProductAddPopup" method="post"
-      asp-route-CustomerId="@Context.Request.Query["CustomerId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]"
-      asp-route-personalized="@Context.Request.Query["personalized"]">
+      asp-route-CustomerId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CustomerId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])"
+      asp-route-personalized="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["personalized"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerAttribute/ValueCreatePopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerAttribute/ValueCreatePopup.cshtml
@@ -5,9 +5,9 @@
     ViewBag.Title = Loc["Admin.Customers.CustomerAttributes.Values.AddNew"];
 }
 <form id="ValueCreatePopup" manifest="ValueCreatePopup" asp-area="@Constants.AreaAdmin" asp-controller="CustomerAttribute" asp-action="ValueCreatePopup"
-      asp-route-customerAttributeId="@Context.Request.Query["customerAttributeId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-customerAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["customerAttributeId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerAttribute/ValueEditPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerAttribute/ValueEditPopup.cshtml
@@ -9,9 +9,9 @@
     ViewBag.Title = Loc["Admin.Customers.CustomerAttributes.Values.EditValueDetails"];
 }
 <form id="ValueEditPopup" asp-area="@Constants.AreaAdmin" asp-controller="CustomerAttribute" asp-action="ValueEditPopup"
-      asp-route-customerAttributeId="@Context.Request.Query["customerAttributeId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-customerAttributeId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["customerAttributeId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/ProductAddPopup.cshtml
@@ -6,9 +6,9 @@
     ViewBag.Title = Loc["Admin.Customers.CustomerGroups.Products.AddNew"];
 }
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="CustomerGroup" asp-action="ProductAddPopup" method="post"
-      asp-route-CustomerGroupId="@Context.Request.Query["CustomerGroupId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-CustomerGroupId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CustomerGroupId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerTag/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerTag/ProductAddPopup.cshtml
@@ -7,9 +7,9 @@
 @inject AdminAreaSettings adminAreaSettings
 
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="CustomerTag" asp-action="ProductAddPopup" method="post"
-      asp-route-CustomerTagId="@Context.Request.Query["CustomerTagId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-CustomerTagId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["CustomerTagId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/BrandAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/BrandAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="BrandAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Discount" asp-action="BrandAddPopup" method="post"
-      asp-route-DiscountId="@Context.Request.Query["DiscountId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-DiscountId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["DiscountId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/CategoryAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/CategoryAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="CategoryAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Discount" asp-action="CategoryAddPopup" method="post"
-      asp-route-DiscountId="@Context.Request.Query["DiscountId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-DiscountId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["DiscountId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <div class="row">
         <div class="col-md-12">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/CollectionAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/CollectionAddPopup.cshtml
@@ -9,9 +9,9 @@
 }
 
 <form id="CollectionAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Discount" asp-action="CollectionAddPopup" method="post"
-      asp-route-DiscountId="@Context.Request.Query["DiscountId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-DiscountId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["DiscountId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/ProductAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/ProductAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="ProductAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Discount" asp-action="ProductAddPopup" method="post"
-      asp-route-DiscountId="@Context.Request.Query["DiscountId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-DiscountId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["DiscountId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/VendorAddPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Discount/VendorAddPopup.cshtml
@@ -7,9 +7,9 @@
 }
 
 <form id="VendorAddPopup" asp-area="@Constants.AreaAdmin" asp-controller="Discount" asp-action="VendorAddPopup" method="post"
-      asp-route-DiscountId="@Context.Request.Query["DiscountId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-DiscountId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["DiscountId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
 
     <div class="row">

diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Knowledgebase/ArticlesPopup.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Knowledgebase/ArticlesPopup.cshtml
@@ -5,9 +5,9 @@
     Layout = "";
 }
 <form id="ArticlesPopup" asp-area="@Constants.AreaAdmin" asp-controller="Knowledgebase" asp-action="ArticlesPopup" method="post"
-      asp-route-KnowledgebaseId="@Context.Request.Query["KnowledgebaseId"]"
-      asp-route-btnId="@Context.Request.Query["btnId"]"
-      asp-route-formId="@Context.Request.Query["formId"]">
+      asp-route-KnowledgebaseId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["KnowledgebaseId"])"
+      asp-route-btnId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["btnId"])"
+      asp-route-formId="@HtmlExtensions.HtmlEncodeSafe(Context.Request.Query["formId"])">
 
     <input asp-for="ArticleId" type="hidden"/>
     <div class="row">