mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 05:58:40 -04:00
Remove vulnerable and unused code path for displaying errors (#9395)
If we were to remove or rename `errorController`, an HTML injection could potentially be introduced due to the fallback code path, that directly echoes the logs without any escaping. (but mainly removing it to reduce the amount of code, and since it's unused)
This commit is contained in:
1 parent
d5e13066bc
commit
4e5e142cd0
1 file changed
+5
-20
+5
-20
@@ -23,28 +23,13 @@ class Minz_Error {
|
||||
*/
|
||||
public static function error(int $code = 404, string|array $logs = [], bool $redirect = true): void {
|
||||
$logs = self::processLogs($logs);
|
||||
$error_filename = APP_PATH . '/Controllers/errorController.php';
|
||||
|
||||
if (file_exists($error_filename)) {
|
||||
Minz_Session::_params([
|
||||
'error_code' => $code,
|
||||
'error_logs' => $logs,
|
||||
]);
|
||||
Minz_Session::_params([
|
||||
'error_code' => $code,
|
||||
'error_logs' => $logs,
|
||||
]);
|
||||
|
||||
Minz_Request::forward(['c' => 'error'], $redirect);
|
||||
} else {
|
||||
echo '<h1>An error occurred</h1>' . "\n";
|
||||
|
||||
if (!empty($logs)) {
|
||||
echo '<ul>' . "\n";
|
||||
foreach ($logs as $log) {
|
||||
echo '<li>' . $log . '</li>' . "\n";
|
||||
}
|
||||
echo '</ul>' . "\n";
|
||||
}
|
||||
|
||||
exit();
|
||||
}
|
||||
Minz_Request::forward(['c' => 'error'], $redirect);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in new issue
Block a user