Files
FreshRSS/lib/Minz/Error.php
T
Inverle 4e5e142cd0 Remove vulnerable and unused code path for displaying errors (#9395)
If we were to remove or rename `errorController`, an HTML injection could potentially be introduced due to the fallback code path, that directly echoes the logs without any escaping.

(but mainly removing it to reduce the amount of code, and since it's unused)
2026-10-03 23:28:39 +02:00

68 lines
1.8 KiB
PHP

<?php
declare(strict_types=1);
/**
* MINZ - Copyright 2011 Marien Fressinaud
* Sous licence AGPL3 <https://www.gnu.org/licenses/>
*/
/**
* The Minz_Error class logs and raises framework errors
*/
class Minz_Error {
public function __construct() {}
/**
* Permet de lancer une erreur
* @param int $code le type de l'erreur, par défaut 404 (page not found)
* @param string|array<'error'|'warning'|'notice',list<string>> $logs logs d'erreurs découpés de la forme
* > $logs['error']
* > $logs['warning']
* > $logs['notice']
* @param bool $redirect indique s'il faut forcer la redirection (les logs ne seront pas transmis)
*/
public static function error(int $code = 404, string|array $logs = [], bool $redirect = true): void {
$logs = self::processLogs($logs);
Minz_Session::_params([
'error_code' => $code,
'error_logs' => $logs,
]);
Minz_Request::forward(['c' => 'error'], $redirect);
}
/**
* Returns filtered logs
* @param string|array<'error'|'warning'|'notice',list<string>> $logs logs sorted by category (error, warning, notice)
* @return list<string> list of matching logs, without the category, according to environment preferences (production / development)
*/
private static function processLogs(string|array $logs): array {
if (is_string($logs)) {
return [$logs];
}
$error = [];
$warning = [];
$notice = [];
if (is_array($logs['error'] ?? null)) {
$error = $logs['error'];
}
if (is_array($logs['warning'] ?? null)) {
$warning = $logs['warning'];
}
if (is_array($logs['notice'] ?? null)) {
$notice = $logs['notice'];
}
switch (Minz_Configuration::get('system')->environment) {
case 'development':
return array_merge($error, $warning, $notice);
case 'production':
default:
return $error;
}
}
}