From 5502087cb022297c57feaf3f69ca62efa3a3925f Mon Sep 17 00:00:00 2001
From: Buster Neece <buster@busterneece.com>
Date: Sat, 22 Apr 2023 20:10:42 -0500
Subject: [PATCH] Clean up and improve escaping on public-facing error pages.

---
 templates/system/error_general.phtml | 20 +++++++++++++++-----
 templates/system/error_http.phtml    | 10 ++++++----
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/templates/system/error_general.phtml b/templates/system/error_general.phtml
index 61940cd717..26ed34b0c7 100644
--- a/templates/system/error_general.phtml
+++ b/templates/system/error_general.phtml
@@ -1,17 +1,27 @@
 <?php
+/**
+ * @var Exception $exception
+ * @var App\Environment $environment
+ */
+
 $this->layout('minimal', [
     'title' => 'Error',
-    'page_class' => 'error-content'
+    'page_class' => 'error-content',
 ]);
+
+$filePath = Symfony\Component\Filesystem\Path::makeRelative(
+    $exception->getFile(),
+    $environment->getBaseDirectory()
+);
 ?>
 
 <div class="public-page">
     <div class="card">
         <div class="card-body">
-            <h2 class="display-1 mt-2">500</h2>
-            <p>
-                <?= $exception->getMessage() ?><br>
-                <?= basename($exception->getFile()) ?> : <?= $exception->getLine() ?>
+            <h2 class="display-1">500</h2>
+            <h4><?= $this->e($exception->getMessage()) ?></h4>
+            <p class="text-muted card-text mb-0">
+                <?= $this->e($filePath) ?> : L<?= $exception->getLine() ?>
             </p>
 
             <a role="button" title="<?= __('Dashboard') ?>" class="btn btn-login btn-primary btn-float" href="/">
diff --git a/templates/system/error_http.phtml b/templates/system/error_http.phtml
index d2c4e3eec2..9ea51b0230 100644
--- a/templates/system/error_http.phtml
+++ b/templates/system/error_http.phtml
@@ -10,11 +10,13 @@ $this->layout('minimal', [
 <div class="public-page">
     <div class="card">
         <div class="card-body">
-            <h2 class="display-2 mt-2"><?=$exception->getCode()?></h2>
-            <h4><?=$exception->getMessage()?></h4>
-            <p><?=$exception->getDescription()?></p>
+            <h2 class="display-1"><?= $this->e($exception->getCode()) ?></h2>
+            <h4><?= $this->e($exception->getMessage()) ?></h4>
+            <p class="text-muted card-text mb-0">
+                <?= $this->e($exception->getDescription()) ?>
+            </p>
 
-            <a role="button" title="<?=__('Dashboard')?>" class="btn btn-login btn-primary btn-float"
+            <a role="button" title="<?= __('Dashboard') ?>" class="btn btn-login btn-primary btn-float"
                href="/">
                 <i class="material-icons" aria-hidden="true">home</i>
             </a>