Merge commit from fork

Escape parameters in various error output
jpatokal · Aug 22, 2024 · 3ada5ee · 3ada5ee
2 parents 92f2431 + 36733f4
commit 3ada5ee
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/php/settings.php b/php/settings.php
@@ -57,7 +57,7 @@
         break;
 
     default:
-        die("0;" . sprintf(_("Unknown action %s"), $type));
+        die("0;" . sprintf(_("Unknown action %s"), htmlspecialchars($type)));
 }
 
 // Note: Password is actually an MD5 hash of pw and username

diff --git a/php/submit.php b/php/submit.php
@@ -203,7 +203,7 @@
         break;
 
     default:
-        die('0;Unknown operation ' . $param);
+        die('0;Unknown operation ' . htmlspecialchars($param));
 }
 
 print "$code;$msg";
diff --git a/php/trip.php b/php/trip.php
@@ -52,7 +52,7 @@ function failIfFalse($res, $name) {
         break;
 
     default:
-        die('0;Unknown operation ' . $type);
+        die('0;Unknown operation ' . htmlspecialchars($type));
 }
 
 failIfFalse($success, $name);