Просмотр исходного кода

Fix path disclosure in cache error message (#9206)

I mentioned it here before: https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-6c8h-w3j5-j293#advisory-comment-138339 (though it was maybe not needed)

There is no reason to print the full path of the FreshRSS directory to the user or the logged in admin. (file_put_contents will probably output a more useful message anyway in PHP error log)

Introduced in https://github.com/FreshRSS/FreshRSS/pull/4220
Inverle 3 недель назад
Родитель
Сommit
7529c71a77
1 измененных файлов с 1 добавлено и 1 удалено
  1. 1 1
      app/Utils/httpUtil.php

+ 1 - 1
app/Utils/httpUtil.php

@@ -738,7 +738,7 @@ final class FreshRSS_http_Util {
 		}
 
 		if ($cachePath !== null && file_put_contents($cachePath, $body) === false) {
-			Minz_Log::warning("Error saving cache $cachePath for $url");
+			Minz_Log::warning("Error saving cache for $url");
 		}
 
 		return ['body' => is_string($body) ? $body : '', 'effective_url' => $c_effective_url, 'redirect_count' => $redirs,