Escape error template message output

cakephp · Jul 28, 2014 · e0c5c4e · e0c5c4e
1 parent 84e4b8d
commit e0c5c4e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/tests/test_app/TestApp/Template/Error/error400.ctp b/tests/test_app/TestApp/Template/Error/error400.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= sprintf(

diff --git a/tests/test_app/TestApp/Template/Error/error500.ctp b/tests/test_app/TestApp/Template/Error/error500.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message; ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= __d('cake', 'An Internal Error Has Occurred.'); ?>