fixed Cross-site Scripting (XSS)

mixisLv · web-flow · commit 9488cac84a19 · 2022-12-08T21:44:01.000+02:00
diff --git a/src/Api.php b/src/Api.php
@@ -214,7 +214,7 @@ private function getUrl($action, $method, $params)
     protected function log($message)
     {
         if ($this->debug) {
-            echo '<pre>', $message, '</pre>';
+            echo '<pre>', htmlspecialchars($message, ENT_QUOTES, 'UTF-8'), '</pre>';
         }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -214,7 +214,7 @@ private function getUrl($action, $method, $params)`
`214`	`214`	`protected function log($message)`
`215`	`215`	`{`
`216`	`216`	`if ($this->debug) {`
`217`		`- echo '<pre>', $message, '</pre>';`
	`217`	`+ echo '<pre>', htmlspecialchars($message, ENT_QUOTES, 'UTF-8'), '</pre>';`
`218`	`218`	`}`
`219`	`219`	`}`
`220`	`220`