From 9e8a17655a5577e40df544af99e0b8f37a7aa8b4 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sun, 16 May 2021 14:38:19 +0200
Subject: Minz provide action name in controller exception (#3624)

Contributes to https://github.com/FreshRSS/FreshRSS/issues/3584
---
 lib/Minz/ActionException.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/Minz/ActionException.php b/lib/Minz/ActionException.php
index 311f15086..82f250958 100644
--- a/lib/Minz/ActionException.php
+++ b/lib/Minz/ActionException.php
@@ -1,7 +1,10 @@
 <?php
 class Minz_ActionException extends Minz_Exception {
 	public function __construct ($controller_name, $action_name, $code = self::ERROR) {
-		$message = 'Invalid action name for controller ' . $controller_name;
+		// Just for security, as we are not supposed to get non-alphanumeric characters.
+		$action_name = rawurlencode($action_name);
+
+		$message = "Invalid action name “${action_name}” for controller “${controller_name}”.";
 		parent::__construct ($message, $code);
 	}
 }
-- 
cgit v1.2.3