tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

BUGFIX Don't allow HTML formatting in RequestHandler->httpError() by sending "Content-Type: text/plain" response headers.

Browse Source 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/trunk@114444 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Ingo Schommer 2010-12-02 08:03:17 +00:00
parent 07b6d1870a
commit 640b504ebe
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
core/control/RequestHandler.php
View File

@ -301,11 +301,16 @@ class RequestHandler extends ViewableData {
* {@link RequestHandler::handleAction()} and returned to the user.
*
* @param int $errorCode
* @param string $errorMessage
* @param string $errorMessage Plaintext error message
* @uses SS_HTTPResponse_Exception
*/
public function httpError($errorCode, $errorMessage = null) {
throw new SS_HTTPResponse_Exception($errorMessage, $errorCode);
$e = new SS_HTTPResponse_Exception($errorMessage, $errorCode);
// Error responses should always be considered plaintext, for security reasons
$e->getResponse()->addHeader('Content-Type', 'text/plain');
throw $e;
}
/**