Use htmlentities on the error message when dying because the string will be sent to the browser and if it includes scripts they will be run.

2016-12-08 15:52:21 -05:00 · 2016-12-08 15:52:21 -05:00 · 42fdd1fbe9
parent 75b8c35059
commit 42fdd1fbe9
1 changed files with 1 additions and 1 deletions
--- a/web/includes/logger.php
+++ b/web/includes/logger.php
@ -528,7 +528,7 @@ function Error( $string )
 function Fatal( $string )
 {
    Logger::fetch()->logPrint( Logger::FATAL, $string );
-    die( $string );
+    die( htmlentities($string) );
 }

 function Panic( $string )