Changeset 2548 for trunk/system/views

Show
Ignore:
Timestamp:
04/21/2008 01:47:53 PM (7 months ago)
Author:
Geert
Message:

Security update to prevent XSS.
See: http://forum.kohanaphp.com/comments.php?DiscussionID=352

Location:
trunk/system/views
Files:
2 modified

Legend:

Unmodified
Added
Removed

  • trunk/system/views/kohana_error_disabled.php

    r2287 r2548  
    1010</style> 
    1111<div id="framework_error" style="width:24em;margin:50px auto;"> 
    12 <h3><?php echo $error ?></h3> 
    13 <p style="text-align:center"><?php echo $message ?></p> 
     12<h3><?php echo html::specialchars($error) ?></h3> 
     13<p style="text-align:center"><?php echo html::specialchars($message) ?></p> 
    1414</div> 
    1515</body> 

  • trunk/system/views/kohana_error_page.php

    r2251 r2548  
    1111</style> 
    1212<div id="framework_error" style="width:42em;margin:20px auto;"> 
    13 <h3><?php echo $error ?></h3> 
    14 <p><?php echo $description ?></p> 
     13<h3><?php echo html::specialchars($error) ?></h3> 
     14<p><?php echo html::specialchars($description) ?></p> 
    1515<?php if ( ! empty($line) AND ! empty($file)): ?> 
    1616<p><?php echo Kohana::lang('core.error_file_line', $file, $line) ?></p> 
    1717<?php endif ?> 
    18 <p><code class="block"><?php echo $message ?></code></p> 
     18<p><code class="block"><?php echo html::specialchars($message) ?></code></p> 
    1919<?php if ( ! empty($trace)): ?> 
    2020<h3><?php echo Kohana::lang('core.stack_trace') ?></h3>