Merge pull request #258 from LukasReschke/escape-error-messages

Escape error messages in debug mode

Author: pitbulk

lib/Saml2/LogoutRequest.php

@@ -380,7 +380,7 @@ public function isValid($retrieveParametersFromServer = false)
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/LogoutResponse.php

@@ -188,7 +188,7 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/Response.php

@@ -402,7 +402,7 @@ public function isValid($requestId = null)
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/Utils.php

@@ -134,7 +134,7 @@ public static function validateXML($xml, $schema, $debug = false)
 
             if ($debug) {
                 foreach ($xmlErrors as $error) {
-                    echo $error->message."\n";
+                    echo htmlentities($error->message."\n");
                 }
             }