FOUR-32745: Prevent stored XSS in user directory - #9019

Issue & Reproduction Steps

A low-privilege user can bypass the single-pass profile sanitizer with nested HTML, store executable markup in user profile fields, and trigger it when an authorized user opens /admin/users.

1. Update firstname, lastname, or title through PUT /api/1.0/users/{id} using a nested HTML payload.
2. Retrieve the stored user and observe that the payload has become executable markup.
3. Open /admin/users as a user with directory access.
4. Observe that the stored payload executes in the viewer's session.

Solution

• Validate firstname, lastname, and title as plain text before persistence.
• Require edit-personal-profile and enforce a profile-field allowlist for non-administrative self-service updates.
• Keep username and password changes protected by edit-user-and-password.
• Send only profile-editable fields from the profile page.
• Render fullname through escaped Vue slots in active and deleted user listings.
• Add regression coverage for markup validation, authorization, atomic rejection, credential permissions, and administrative updates.

How to Test

• Run ./vendor/bin/phpunit tests/unit/ProcessMaker/Rules/PlainTextTest.php tests/Feature/Api/UsersTest.php tests/Feature/ProfileTest.php.
• Run npm run development.
• Confirm markup payloads return 422, unauthorized or disallowed self-service updates return 403, and valid updates return 204.
• Open both Users and Deleted Users and confirm existing malicious names appear as literal text without creating executable DOM nodes or JavaScript dialogs.

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-32745

ci:deploy