Project

General

Profile

Actions
Copy link

Bug #15264

closed
JP JP

``crash_reporter.php`` displays PHP Error log without encoding

Bug #15264: ``crash_reporter.php`` displays PHP Error log without encoding

Added by Jim Pingle over 2 years ago. Updated over 2 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Diagnostics
Target version:
2.8.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
24.03
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The section of crash_reporter.php that displays the PHP error log is printing that log directly without encoding the output. If a malicious user can influence the content of the PHP log, such as via the printing of function arguments (See #15263), there is a potential for XSS to occur.

To me, I have a tested and working patch.

JP Updated by Jim Pingle over 2 years ago Actions
Copy link
 #1

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:bde72e2d864ba57f2f14e0a4005104d942cdb11d.

JP Updated by Jim Pingle over 2 years ago Actions
Copy link
 #2

  • Status changed from Feedback to Resolved

HTML tags in the PHP log are no longer interpreted, the contents are displayed exactly as they are in the file.

JP Updated by Jim Pingle over 2 years ago Actions
Copy link
 #3

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom