mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-07-13 03:44:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Remove project path in twig label error messages to prevent information leakage

Browse source
This commit is contained in:
Jan Böhmer 2024-08-23 22:28:29 +02:00
parent 77671550a7
commit 5231dbd6e7
4 changed files with 66 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/Controller/AdminPages/BaseAdminController.php
View file

@ -217,7 +217,7 @@ abstract class BaseAdminController extends AbstractController
try {
$pdf_data = $this->labelGenerator->generateLabel($entity->getOptions(), $example);
} catch (TwigModeException $exception) {
$form->get('options')->get('lines')->addError(new FormError($exception->getMessage()));
$form->get('options')->get('lines')->addError(new FormError($exception->getSafeMessage()));
}
}

2
src/Controller/LabelController.php
View file

@ -117,7 +117,7 @@ class LabelController extends AbstractController
$pdf_data = $this->labelGenerator->generateLabel($form_options, $targets);
$filename = $this->getLabelName($targets[0], $profile);
} catch (TwigModeException $exception) {
$form->get('options')->get('lines')->addError(new FormError($exception->getMessage()));
$form->get('options')->get('lines')->addError(new FormError($exception->getSafeMessage()));
}
} else {
//$this->addFlash('warning', 'label_generator.no_entities_found');

15
src/Exceptions/TwigModeException.php
View file

@ -46,8 +46,23 @@ use Twig\Error\Error;
class TwigModeException extends RuntimeException
{
private const PROJECT_PATH = __DIR__ . '/../../';
public function __construct(?Error $previous = null)
{
parent::__construct($previous->getMessage(), 0, $previous);
}
/**
* Returns the message of this exception, where it is tried to remove any sensitive information (like filepaths).
* @return string
*/
public function getSafeMessage(): string
{
//Resolve project root path
$projectPath = realpath(self::PROJECT_PATH);
//Remove occurrences of the project path from the message
return str_replace($projectPath, '[Part-DB Root Folder]', $this->getMessage());
}
}