Actions
Bug #15264
closed
``crash_reporter.php`` displays PHP Error log without encoding
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
24.03
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The section of crash_reporter.php that displays the PHP error log is printing that log directly without encoding the output. If a malicious user can influence the content of the PHP log, such as via the printing of function arguments (See #15263), there is a potential for XSS to occur.
To me, I have a tested and working patch.
Updated by
Actions