Skip to content

Fix information exposure in OrderInvoiceController and OrderShipmentController #2962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpfaffenbauer merged 4 commits into from
Jan 30, 2026
+2 −4
Merged

Fix information exposure in OrderInvoiceController and OrderShipmentController #2962

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ebc277a
Initial plan
Copilot Jan 29, 2026
fa143d9
Fix information exposure vulnerability in OrderInvoiceController and …
Copilot Jan 29, 2026
ac3b8a8
Return HTTP 500 status code on error in renderAction methods
Copilot Jan 29, 2026
de3345e
Remove logging and simplify error response in renderAction methods
Copilot Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion src/CoreShop/Bundle/OrderBundle/Controller/OrderInvoiceController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
use CoreShop\Component\Pimcore\DataObject\NoteServiceInterface;
use CoreShop\Component\Resource\Factory\FactoryInterface;
use CoreShop\Component\Resource\Factory\PimcoreFactoryInterface;
use Psr\Log\LoggerInterface;
use Symfony\Component\DependencyInjection\Attribute\Autowire;
use Symfony\Component\EventDispatcher\GenericEvent;
use Symfony\Component\HttpFoundation\JsonResponse;
Expand Down Expand Up @@ -187,8 +188,18 @@ public function renderAction(Request $request): Response
'Content-Disposition' => 'inline; filename="invoice-' . $invoice->getId() . '.pdf"',
];
} catch (\Exception $e) {
$responseData = '<strong>' . $e->getMessage() . '</strong><br>trace: ' . $e->getTraceAsString();
$this->container->get(LoggerInterface::class)->error(
Copy link
Member

@dpfaffenbauer dpfaffenbauer Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot remove log and don't overexpose response

Copy link
Contributor Author

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the logging and simplified the error response to just return a generic message with HTTP 500 status. Fixed in de3345e.

'Failed to render invoice PDF',
[
'invoiceId' => $invoice->getId(),
'exception' => $e->getMessage(),
'trace' => $e->getTraceAsString(),
],
);
$responseData = 'An error occurred while rendering the invoice. Please try again later.';
$header = ['Content-Type' => 'text/html'];

return new Response($responseData, 500, $header);
}

return new Response($responseData, 200, $header);
Expand Down Expand Up @@ -244,6 +255,7 @@ public static function getSubscribedServices(): array
new SubscribedService('coreshop.order.transformer.order_to_invoice', OrderDocumentTransformerInterface::class, attributes: new Autowire('@CoreShop\Component\Order\Transformer\OrderToInvoiceTransformer')),
new SubscribedService('coreshop.repository.order_invoice', OrderInvoiceRepositoryInterface::class, attributes: new Autowire(service:'coreshop.repository.order_invoice')),
new SubscribedService(StateMachineManagerInterface::class, StateMachineManagerInterface::class),
new SubscribedService(LoggerInterface::class, LoggerInterface::class),
]);
}
}
14 changes: 13 additions & 1 deletion src/CoreShop/Bundle/OrderBundle/Controller/OrderShipmentController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
use CoreShop\Component\Order\Transformer\OrderToShipmentTransformer;
use CoreShop\Component\Resource\Factory\FactoryInterface;
use CoreShop\Component\Resource\Repository\PimcoreRepositoryInterface;
use Psr\Log\LoggerInterface;
use Symfony\Component\DependencyInjection\Attribute\Autowire;
use Symfony\Component\EventDispatcher\GenericEvent;
use Symfony\Component\HttpFoundation\JsonResponse;
Expand Down Expand Up @@ -183,8 +184,18 @@ public function renderAction(Request $request): Response
'Content-Disposition' => 'inline; filename="shipment-' . $shipment->getId() . '.pdf"',
];
} catch (\Exception $e) {
$responseData = '<strong>' . $e->getMessage() . '</strong><br>trace: ' . $e->getTraceAsString();
$this->container->get(LoggerInterface::class)->error(
'Failed to render shipment PDF',
[
'shipmentId' => $shipment->getId(),
'exception' => $e->getMessage(),
'trace' => $e->getTraceAsString(),
],
);
$responseData = 'An error occurred while rendering the shipment. Please try again later.';
$header = ['Content-Type' => 'text/html'];

return new Response($responseData, 500, $header);
}

return new Response($responseData, 200, $header);
Expand Down Expand Up @@ -240,6 +251,7 @@ public static function getSubscribedServices(): array
new SubscribedService('event_dispatcher', EventDispatcherInterface::class),
new SubscribedService(OrderToShipmentTransformer::class, OrderToShipmentTransformer::class),
new SubscribedService(ErrorSerializer::class, ErrorSerializer::class),
new SubscribedService(LoggerInterface::class, LoggerInterface::class),
]);
}
}