Escape error message

tecnickcom · Dec 23, 2024 · 11778aa · 11778aa
1 parent 5c046cc
commit 11778aa
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.TXT b/CHANGELOG.TXT
@@ -1,5 +1,5 @@
 6.8.0 (2024-12-23)
-	- 
+	- Escape error message.
 
 6.7.8 (2024-12-13)
 	- Improve SVG detection by checking for (mandatory) namespace.

diff --git a/tcpdf.php b/tcpdf.php
@@ -3007,6 +3007,7 @@ public function setAllowLocalFiles($allowLocalFiles) {
 	public function Error($msg) {
 		// unset all class variables
 		$this->_destroy(true);
+		$msg = htmlspecialchars($msg, ENT_QUOTES, 'UTF-8');
 		if (defined('K_TCPDF_THROW_EXCEPTION_ERROR') AND !K_TCPDF_THROW_EXCEPTION_ERROR) {
 			die('<strong>TCPDF ERROR: </strong>'.$msg);
 		} else {