Add HTML purification to status messages

This is a security protection measure that protects us just a little bit
more against XSS.

diff --git a/CRM/Core/Session.php b/CRM/Core/Session.php
index ccadd74bcda457240cbbfc7d97c12a90654b3a52..7c1c1a42a1a3f3922712c94cf92ea47c73157822 100644 (file)
--- a/CRM/Core/Session.php
+++ b/CRM/Core/Session.php
@@ -471,6 +471,10 @@ class CRM_Core_Session {
     $session = self::singleton();
     $session->initialize();
 
+    // Sanitize any HTML we're displaying. This helps prevent reflected XSS in error messages.
+    $text = CRM_Utils_String::purifyHTML($text);
+    $title = CRM_Utils_String::purifyHTML($title);
+
     // default options
     $options += array('unique' => TRUE);