Actions
Bug #15264
closed
``crash_reporter.php`` displays PHP Error log without encoding
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
24.03
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The section of crash_reporter.php that displays the PHP error log is printing that log directly without encoding the output. If a malicious user can influence the content of the PHP log, such as via the printing of function arguments (See #15263), there is a potential for XSS to occur.
To me, I have a tested and working patch.
Updated by Jim Pingle 3 months ago
- Status changed from New to Feedback
- % Done changed from 0 to 100
Applied in changeset bde72e2d864ba57f2f14e0a4005104d942cdb11d.
Updated by Jim Pingle about 1 month ago
- Status changed from Feedback to Resolved
HTML tags in the PHP log are no longer interpreted, the contents are displayed exactly as they are in the file.
Actions