Merge pull request #377 from chemezov/chemezov-fix-xss-1

fixed XSS on error page
luyadev · May 24, 2022 · 00ba99c · 00ba99c
2 parents e69a13b + 333c1e6
commit 00ba99c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,7 @@ In order to read more about upgrading and BC breaks have a look at the [UPGRADE
 ## 4.2.1
 
 + [#375](https://github.com/luyadev/luya-module-cms/pull/375) Fixed Website delete event
++ [#377](https://github.com/luyadev/luya-module-cms/pull/377) Fixed XSS on error page
 
 ## 4.2.0 (9. December 2021)
 

diff --git a/src/frontend/views/error/index.php b/src/frontend/views/error/index.php
@@ -1,3 +1,6 @@
+<?php
+use \luya\helpers\Html;
+?>
 <html>
 <head>
     <!-- Latest compiled and minified CSS -->
@@ -23,7 +26,7 @@
         <div class="span12">
             <div class="hero-unit center">
                 <?php if ($exception !== null): ?>
-                    <h1><?php echo $exception->getMessage(); ?>
+                    <h1><?php echo Html::encode($exception->getMessage()); ?>
                         <small><br/><br/>
                         <p class="red">Error <?php echo $exception->statusCode; ?></p></small>
                     </h1>
@@ -37,4 +40,4 @@
     </div>
 </div>
 </body>
-</html>
+</html>