wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Do not use file as template parameter

Browse source 
Using file will overwrite the $file parameter in the template base.
Leading to trying to include a file that is the exception message. Which
will of course fail.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2018-08-09 14:27:20 +02:00
parent 88603e98f8
commit 8c1e75e052
No known key found for this signature in database
GPG key ID: F941078878347C0C
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/templates/403.php
View file

@ -12,6 +12,6 @@ if(!isset($_)) {//standalone page is not supported anymore - redirect to /
<ul>
<li class='error'>
<?php p($l->t( 'Access forbidden' )); ?><br>
<p class='hint'><?php if(isset($_['file'])) p($_['file'])?></p>
<p class='hint'><?php if(isset($_['message'])) p($_['message'])?></p>
</li>
</ul>

2
lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
View file

@ -249,7 +249,7 @@ class SecurityMiddleware extends Middleware {
$url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
$response = new RedirectResponse($url);
} else {
$response = new TemplateResponse('core', '403', ['file' => $exception->getMessage()], 'guest');
$response = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
$response->setStatus($exception->getCode());
}
}

2
tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php
View file

@ -568,7 +568,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
'test',
$exception
);
$expected = new TemplateResponse('core', '403', ['file' => $exception->getMessage()], 'guest');
$expected = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
$expected->setStatus($exception->getCode());
$this->assertEquals($expected , $response);
}