Escape request params.

[ADmad]

Mitigate potential XSS issue.

[ndm2]

Although I'm not sure how it would be possible for it to slip in there, Salines said the problem also occurred on other pages like login. Just in case, the example layouts should maybe apply the same escaping to the request params.

[codecov]

Codecov Report

Merging #360 (6fe6ddb) into master (b622d37) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master     #360   +/-   ##
=========================================
  Coverage     99.19%   99.19%           
  Complexity      335      335           
=========================================
  Files            20       20           
  Lines           869      869           
=========================================
  Hits            862      862           
  Misses            7        7           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b622d37...6fe6ddb. Read the comment docs.

[ADmad]

I too don't see how the problem could occur for other pages besides error pages but still escaped them for all layouts.

[ndm2]

Yeah, better safe than sorry I guess. I've tried to reproduce it with non-error pages, but no luck 🤷‍♂️

There's one left hiding in the dashboard's header

bootstrap-ui/templates/layout/examples/dashboard.php

Line 31 in d96507c

<h1 class="page-header"><?= $this->request->getParam('controller'); ?></h1>