Skip to content

Commit 943cbd6

Browse files
authored
Remove JSONP callback support in modConnectorResponse (#16775)
### What does it do? Removes the JSONP callback support in modConnectorResponse. ### Why is it needed? This feature is potentially vulnerable to JSONP injection. ### How to test Make sure any callback parameters to a connector request are ignored. ### Related issue(s)/PR(s) #12420 and #13051 — vulnerability was reported privately.
1 parent a94a0f6 commit 943cbd6

File tree

1 file changed

+0
-3
lines changed

1 file changed

+0
-3
lines changed

core/src/Revolution/modConnectorResponse.php

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -192,9 +192,6 @@ public function outputContent(array $options = [])
192192
'object' => isset($this->body['object']) ? $this->body['object'] : [],
193193
]);
194194

195-
if (!empty($_GET['callback'])) {
196-
$json = $modx->stripTags($_GET['callback']) . '(' . $json . ')';
197-
}
198195
die($json);
199196
} else {
200197
@session_write_close();

0 commit comments

Comments
 (0)