Actions
Bug #15264
closed
``crash_reporter.php`` displays PHP Error log without encoding
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
24.03
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The section of crash_reporter.php that displays the PHP error log is printing that log directly without encoding the output. If a malicious user can influence the content of the PHP log, such as via the printing of function arguments (See #15263), there is a potential for XSS to occur.
To me, I have a tested and working patch.
Updated by Jim Pingle over 2 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 100
Applied in changeset commit:bde72e2d864ba57f2f14e0a4005104d942cdb11d.
Updated by Jim Pingle over 2 years ago
- Status changed from Feedback to Resolved
HTML tags in the PHP log are no longer interpreted, the contents are displayed exactly as they are in the file.
Actions
Also available in: Atom