Merge pull request from GHSA-mj9p-v2r8-wf8w

jaimeperez · web-flow · commit 864f03924803 · 2020-01-24T10:57:02.000+01:00
* Update the changelog

Signed-off-by: Jaime Pérez Crespo &lt;jaime.perez@uninett.no&gt;

* Bump version

Signed-off-by: Jaime Pérez Crespo &lt;jaime.perez@uninett.no&gt;

* Fix for XSS in email class

Signed-off-by: Jaime Pérez Crespo &lt;jaime.perez@uninett.no&gt;

* Fix issue with reportId not being properly sanitized

Signed-off-by: Jaime Pérez Crespo &lt;jaime.perez@uninett.no&gt;
diff --git a/lib/SimpleSAML/Utils/EMail.php b/lib/SimpleSAML/Utils/EMail.php
@@ -274,7 +274,7 @@ public function generateBody($template)
 </head>
 <body>
 <div class="container" style="background: #fafafa; border: 1px solid #eee; margin: 2em; padding: .6em;">
-' . $this->text . '
+' . htmlspecialchars($this->text) . '
 </div>
 </body>
 </html>';
diff --git a/www/errorreport.php b/www/errorreport.php
@@ -17,6 +17,10 @@
 $email = $_REQUEST['email'];
 $text = $_REQUEST['text'];
 
+if (!preg_match('/^[0-9a-f]{8}$/', $reportId)) {
+    throw new \SimpleSAML\Error\Exception('Invalid reportID');
+}
+
 $data = null;
 try {
     $session = \SimpleSAML\Session::getSessionFromRequest();
