From ed09207ecef601b38bff1392ef5e1726e8fc44c5 Mon Sep 17 00:00:00 2001
From: "gerv%gerv.net" <>
Date: Tue, 4 Jan 2005 04:54:57 +0000
Subject: Bug 272620: avoid XSS problem with internal error messages. Patch by
 gerv; r=justdave; a=justdave.

---
 template/en/default/global/code-error.html.tmpl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'template/en/default/global/code-error.html.tmpl')

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index 42172d900..5026d8314 100644
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -256,7 +256,10 @@
     the time this message appeared.
   </p>
   <script type="text/javascript"> <!--
-    document.write("<p>URL: " + document.location + "</p>");
+    document.write("<p>URL: " + 
+                    document.location.href.replace(/&/g,"&amp;")
+                                          .replace(/</g,"&lt;")
+                                          .replace(/>/g,"&gt;") + "</p>");
   // -->
   </script>
 </tt>
-- 
cgit v1.2.3-24-g4f1b