From a476bb6638adac5a713c2fa462cbb1436b96fa98 Mon Sep 17 00:00:00 2001 From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com> Date: Sat, 27 Jun 2026 22:38:53 +0200 Subject: [PATCH] Enforce escaping for dynamic content in views and templates --- formwork/views/errors/partials/debug.php | 4 ++-- formwork/views/errors/partials/header.php | 4 ++-- panel/views/errors/error.php | 16 ++++++++-------- panel/views/layouts/login.php | 2 +- panel/views/layouts/panel.php | 2 +- panel/views/tools/updates.php | 4 ++-- panel/views/users/profile.php | 2 +- site/templates/blog.php | 2 +- site/templates/layouts/site.php | 4 ++-- 9 files changed, 20 insertions(+), 20 deletions(-) diff --git a/formwork/views/errors/partials/debug.php b/formwork/views/errors/partials/debug.php index fe492edc0..b30280d67 100644 --- a/formwork/views/errors/partials/debug.php +++ b/formwork/views/errors/partials/debug.php @@ -1,11 +1,11 @@
-

Uncaught : getMessage() ?>

+

Uncaught : escape($throwable->getMessage()) ?>

$frame) : ?>
attr(['open' => $i === 0]) ?>> $1', $frame['file']) ?>: - config()->get('system.debug.contextLines', 5)) ?> + config()->get('system.debug.contextLines', 5)) ?>
\ No newline at end of file diff --git a/formwork/views/errors/partials/header.php b/formwork/views/errors/partials/header.php index 6a70be067..0b803876a 100644 --- a/formwork/views/errors/partials/header.php +++ b/formwork/views/errors/partials/header.php @@ -2,7 +2,7 @@ - <?= $message ?? 'Internal Server Error' ?> | Formwork + <?= $this->escape($message ?? 'Internal Server Error') ?> | Formwork