From 845098507e0d38639b4f4d354b63b85763b3893d Mon Sep 17 00:00:00 2001 From: Sean Madsen Date: Sun, 22 Apr 2018 09:53:29 -0400 Subject: [PATCH] security/core#3 Improve output escaping for errors - In the template, use either `escape` or `purify` for all outputs. - Remove `htmlspecialchars()` call in PHP since it's now happening in Smarty via `escape`. --- CRM/Core/Error.php | 2 +- templates/CRM/common/fatal.tpl | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/CRM/Core/Error.php b/CRM/Core/Error.php index ab491e8b81..088d252d46 100644 --- a/CRM/Core/Error.php +++ b/CRM/Core/Error.php @@ -329,7 +329,7 @@ class CRM_Core_Error extends PEAR_ErrorStack { */ public static function fatal($message = NULL, $code = NULL, $email = NULL) { $vars = array( - 'message' => htmlspecialchars($message), + 'message' => $message, 'code' => $code, ); diff --git a/templates/CRM/common/fatal.tpl b/templates/CRM/common/fatal.tpl index 4b59d55730..537dee6bde 100644 --- a/templates/CRM/common/fatal.tpl +++ b/templates/CRM/common/fatal.tpl @@ -29,7 +29,7 @@ - {$pageTitle} + {$pageTitle|escape}