makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-03 00:28:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #27 from phpbb/ticket/security-196

Browse source 
[ticket/security-196] Escapes the exception messages before displaying them
This commit is contained in:
Marc Alexander 2016-10-02 22:25:30 +01:00
commit 40354f1f90
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
phpBB/phpbb/event/kernel_exception_subscriber.php
View file

@ -34,6 +34,9 @@ class kernel_exception_subscriber implements EventSubscriberInterface
*/ */
protected $user; protected $user;
/** @var \phpbb\request\type_cast_helper */
protected $type_caster;
/** /**
* Construct method * Construct method
* *
@ -44,6 +47,7 @@ class kernel_exception_subscriber implements EventSubscriberInterface
{ {
$this->template = $template; $this->template = $template;
$this->user = $user; $this->user = $user;
$this->type_caster = new \phpbb\request\type_cast_helper();
} }
/** /**
@ -57,6 +61,7 @@ class kernel_exception_subscriber implements EventSubscriberInterface
$exception = $event->getException(); $exception = $event->getException();
$message = $exception->getMessage(); $message = $exception->getMessage();
$this->type_caster->set_var($message, $message, 'string', false, false);
if ($exception instanceof \phpbb\exception\exception_interface) if ($exception instanceof \phpbb\exception\exception_interface)
{ {