mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Don't print exception message in HTML 

The exception message is potentially influenced by user input and could thus be confusing (e.g. somebody could try to open a file like "Please send a mail to support@foo.com", and then the message would include that string.

It is thus reasonable to not show the exception message by default. Also for the browser view I added an `exit()` at the end, as otherwise the XML exception would be attached.
This commit is contained in:
Lukas Reschke 2016-09-09 13:52:34 +02:00
parent f5aafdc897
commit f715b5ea2e
No known key found for this signature in database
GPG Key ID: B9F6980CF6E759B1
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
apps/dav/lib/Files/BrowserErrorPagePlugin.php
View File

@ -31,7 +31,6 @@ use Sabre\DAV\Server;
use Sabre\DAV\ServerPlugin; use Sabre\DAV\ServerPlugin;
class BrowserErrorPagePlugin extends ServerPlugin { class BrowserErrorPagePlugin extends ServerPlugin {
/** @var Server */ /** @var Server */
private $server; private $server;
@ -88,8 +87,7 @@ class BrowserErrorPagePlugin extends ServerPlugin {
/** /**
* @codeCoverageIgnore * @codeCoverageIgnore
* @param \Exception $ex * @param \Exception $exception
* @param int $httpCode
* @return bool|string * @return bool|string
*/ */
public function generateBody(\Exception $exception) { public function generateBody(\Exception $exception) {
@ -109,10 +107,11 @@ class BrowserErrorPagePlugin extends ServerPlugin {
return $content->fetchPage(); return $content->fetchPage();
} }
/* /**
* @codeCoverageIgnore * @codeCoverageIgnore
*/ */
public function sendResponse() { public function sendResponse() {
$this->server->sapi->sendResponse($this->server->httpResponse); $this->server->sapi->sendResponse($this->server->httpResponse);
exit();
} }
} }

5
apps/dav/templates/exception.php
View File

@ -1,7 +1,5 @@
<?php <?php
/** /**
*
* @author Thomas Müller <thomas.mueller@tmit.eu> * @author Thomas Müller <thomas.mueller@tmit.eu>
* *
* @license GNU AGPL version 3 or any later version * @license GNU AGPL version 3 or any later version
@ -21,10 +19,11 @@
* *
*/ */
style('core', ['styles', 'header']); style('core', ['styles', 'header']);
/** @param $_ array */
?> ?>
<span class="error error-wide"> <span class="error error-wide">
<h2><strong><?php p($_['title']) ?></strong></h2> <h2><strong><?php p($_['title']) ?></strong></h2>
<p><?php p($_['message']) ?></p>
<br> <br>
<h2><strong><?php p($l->t('Technical details')) ?></strong></h2> <h2><strong><?php p($l->t('Technical details')) ?></strong></h2>