keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Ensure arbitrary HTTPException messages are HTML escaped

Browse source 
- These messages can include user-supplied strings
This commit is contained in:
Hypolite Petovan 2023-02-04 19:19:43 -05:00
parent 4e355c0f5e
commit 447709377c
3 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/Module/Special/HTTPException.php
View file

@ -104,6 +104,7 @@ class HTTPException
$tpl = Renderer::getMarkupTemplate('http_status.tpl'); $tpl = Renderer::getMarkupTemplate('http_status.tpl');
$content = Renderer::replaceMacros($tpl, $vars); $content = Renderer::replaceMacros($tpl, $vars);
} catch (\Exception $e) { } catch (\Exception $e) {
$vars = array_map('htmlentities', $vars);
$content = "<h1>{$vars['$title']}</h1><p>{$vars['$message']}</p>"; $content = "<h1>{$vars['$title']}</h1><p>{$vars['$message']}</p>";
if ($this->isSiteAdmin) { if ($this->isSiteAdmin) {
$content .= "<p>{$vars['$thrown']}</p>"; $content .= "<p>{$vars['$thrown']}</p>";

2
view/templates/exception.tpl
View file

@ -1,7 +1,7 @@
<div id="exception" class="generic-page-wrapper"> <div id="exception" class="generic-page-wrapper">
<img class="hare" src="images/friendica-404_svg_flexy-o-hare.png"/> <img class="hare" src="images/friendica-404_svg_flexy-o-hare.png"/>
<h1>{{$title}}</h1> <h1>{{$title}}</h1>
<p>{{$message nofilter}}</p> <p>{{$message}}</p>
{{if $thrown}} {{if $thrown}}
<pre>{{$thrown}} <pre>{{$thrown}}
{{$stack_trace}} {{$stack_trace}}

2
view/templates/http_status.tpl
View file

@ -4,7 +4,7 @@
</head> </head>
<body> <body>
<h1>{{$title}}</h1> <h1>{{$title}}</h1>
<p>{{$message nofilter}}</p> <p>{{$message}}</p>
{{if $trace}} {{if $trace}}
<pre>{{$trace nofilter}}</pre> <pre>{{$trace nofilter}}</pre>
{{/if}} {{/if}}