Stored XSS via unsanitized template upload

Stored XSS in patient portal template import in OpenEMR before 8.3.0 allows remote authenticated users to execute script via template upload. POST /portal/import_template.php stores uploaded template content through DocumentTemplateService and later renders template_content in renderEditorHtml() without sanitizing active HTML or JavaScript; the fix replaces the earlier stripos('<script') check with HTMLPurifier on both write and render paths. Reachability requires Forms Administration permissions and another Forms Administration user to open the template in the HTML editor, after which the injected code runs in that user's browser session and can access or alter data available to that session.