[Security] GDPR security issue fixes

[Anindra123]

• Critical : XSS Vulnerability on consent modal

  • Any user can register with the name <img src=x onerror='....'> this user name is placed directly on the legal consent field thus executing javascript on view
  • To fix this i have first encoded the string using tutor_json_encode then decoded on the javascript file, this ensure the content is rendered as string instead of html element

• CSV Formula Injection Vulnerability

  • Any user when logging in and saving a consent can intercept the request and update the User Agent to something like =HYPERLINK('...') which is saved in the database and rendered on the consent modal, so when admin downloads the csv from the modal it executes the formula and converts the cell.
  • To fix this i have added a new method sanitize_csv_field which makes sure the formula doesn't get executed, this sanitization is done when viewing the consent and during saving

• Misc fixes

  • Removed is_consent_given_by_user which is not being used
  • Updated is_exists to user_exist as is_exists validation method does not exist in ValidationHelper
  • Update response_bad_request to json_response

[shewa12]

Left a couple of inline comments on the consent modal XSS handling and CSV sanitization.

[shewa12]

Instead of creating multiple attributes, create a single attribute and pass the JSON String, then read from the JSON data.