Branch: refs/heads/master Home: https://github.com/phpmyadmin/error-reporting-server Commit: 60fdeed14cb3afcfcad24d504c7de4b24e95141f https://github.com/phpmyadmin/error-reporting-server/commit/60fdeed14cb3afcf... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M composer.json Log Message: ----------- Update the Composer dependencies The constraints of composer.json were last changed in 70ca00307e and several of the installed versions are affected by security advisories: cakephp/cakephp 5.3.2 (CVE-2026-79752, CVE-2026-77635, CVE-2026-77634, CVE-2026-48820), cakephp/debug_kit 5.2.1, squizlabs/php_codesniffer and composer/composer. Refresh all of them to their latest compatible versions and declare the PHP extensions the application requires. mobiledetect is now required by config/bootstrap.php again, it was used there since 6aa5001d70. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: eecc800ca6d2d63cabe8cec4c76e26eb347f90e3 https://github.com/phpmyadmin/error-reporting-server/commit/eecc800ca6d2d63c... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M src/Application.php Log Message: ----------- Remove the obsolete BaseApplication generic tag Cake\Http\BaseApplication is not generic anymore in CakePHP 5.4. The tag was added in 6aa5001d70 and the application class of the CakePHP app skeleton does not have it. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 5deac56d68dd63d462f3a4ebfed55d6594b72716 https://github.com/phpmyadmin/error-reporting-server/commit/5deac56d68dd63d4... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M src/Controller/GithubController.php M src/Controller/NotificationsController.php M src/Model/Table/NotificationsTable.php M src/Model/Table/ReportsTable.php M src/View/Helper/ReportsHelper.php Log Message: ----------- Fix the phpstan errors detected after the dependency update The CakeDC extension now rejects the array access on entities, use the object notation instead. The report lookups are narrowed to an entity before being saved and the Incidents helper property gets the type the extension expects (b25acd961b). Rows are read as arrays in NotificationsController since 9ec1425ae8 and the developer id was set on the table in 51c6b6880d. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: e2be05e8a5b3ca67e2e6461f188b2add8cb1684d https://github.com/phpmyadmin/error-reporting-server/commit/e2be05e8a5b3ca67... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M phpstan-baseline.neon Log Message: ----------- Remove the obsolete entries from the phpstan baseline The baseline generated in 2164997525 has entries that do not match anymore after the fixes of the previous commit. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: a20934b5003a1aee50fb5a79edf45e04aae7f279 https://github.com/phpmyadmin/error-reporting-server/commit/a20934b5003a1aee... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M src/Command/CleanOldNotifsCommand.php M src/Command/StatsCommand.php M src/Command/SyncGithubIssueStatesCommand.php M src/Controller/AppController.php M src/Controller/Component/GithubApiComponent.php M src/Controller/Component/OrderSearchComponent.php M src/Controller/DevelopersController.php M src/Controller/ErrorController.php M src/Controller/EventsController.php M src/Controller/GithubController.php M src/Controller/IncidentsController.php M src/Controller/NotificationsController.php M src/Controller/ReportsController.php M src/Controller/StatsController.php M src/Mailer/Transport/TestTransport.php M src/Middleware/CsrfProtectionMiddleware.php M src/Model/Table/IncidentsTable.php M src/Report.php M src/View/Helper/ReportsHelper.php M tests/TestCase/Controller/DevelopersControllerTest.php M tests/TestCase/Controller/EventsControllerTest.php M tests/TestCase/Controller/GithubControllerTest.php M tests/TestCase/Controller/IncidentsControllerTest.php M tests/TestCase/Controller/NotificationsControllerTest.php M tests/TestCase/Controller/ReportsControllerTest.php M tests/TestCase/Model/Table/DevelopersTableTest.php M tests/TestCase/Model/Table/IncidentsTableTest.php M tests/TestCase/Model/Table/NotificationsTableTest.php M tests/TestCase/Model/Table/ReportsTableTest.php M tests/TestCase/ReportTest.php M tests/TestCase/View/Helper/ReportsHelperTest.php Log Message: ----------- Apply the new coding standard fixes Auto fixes from the coding standard rules of b25acd961b, applied after the dependency update. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: ea8744460750cd6f66ec1530fe48bd045ad0e98e https://github.com/phpmyadmin/error-reporting-server/commit/ea8744460750cd6f... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M composer.json Log Message: ----------- Update the coding standard to version 5 This brings PHP_CodeSniffer 4 and the Doctrine coding standard 14. The ruleset of b25acd961b still applies to them. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 790ccf12f4ab75b52d6ed739cf6e3ef2e3cbe1e0 https://github.com/phpmyadmin/error-reporting-server/commit/790ccf12f4ab75b5... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M config/Migrations/20150607191654_initial.php M config/Migrations/20150607192040_add_report_id_index_to_incidents.php M config/Migrations/20170515135017_fix_long_pma_versions.php M config/Migrations/20170530155816_fix_stale_report_states.php M config/routes.php M phpstan-baseline.neon M src/Command/CleanOldNotifsCommand.php M src/Command/ConsoleCommand.php M src/Command/SyncGithubIssueStatesCommand.php M src/Controller/AppController.php M src/Controller/Component/GithubApiComponent.php M src/Controller/Component/MailerComponent.php M src/Controller/Component/OrderSearchComponent.php M src/Controller/DevelopersController.php M src/Controller/EventsController.php M src/Controller/GithubController.php M src/Controller/IncidentsController.php M src/Controller/NotificationsController.php M src/Controller/ReportsController.php M src/Forwarding/Sentry.php M src/Mailer/Transport/TestTransport.php M src/Middleware/AuthenticationMiddleware.php M src/Middleware/CsrfProtectionMiddleware.php M src/Model/Table/DevelopersTable.php M src/Model/Table/IncidentsTable.php M src/Model/Table/NotificationsTable.php M src/Model/Table/ReportsTable.php M src/Report.php M src/View/Helper/ReportsHelper.php M templates/Error/error400.php M templates/Github/create_issue.php M templates/Incidents/view.php M templates/Notifications/index.php M templates/Reports/index.php M templates/Reports/view.php M templates/Stats/stats.php M templates/email/html/report.php M templates/layout/default.php M templates/layout/rss/default.php M tests/Fixture/DevelopersFixture.php M tests/Fixture/IncidentsFixture.php M tests/Fixture/NotificationsFixture.php M tests/Fixture/ReportsFixture.php M tests/TestCase/Controller/DevelopersControllerTest.php M tests/TestCase/Controller/EventsControllerTest.php M tests/TestCase/Controller/GithubControllerTest.php M tests/TestCase/Controller/IncidentsControllerTest.php M tests/TestCase/Controller/NotificationsControllerTest.php M tests/TestCase/Controller/ReportsControllerTest.php M tests/TestCase/Model/Table/DevelopersTableTest.php M tests/TestCase/Model/Table/IncidentsTableTest.php M tests/TestCase/Model/Table/ReportsTableTest.php M tests/TestCase/ReportTest.php M tests/TestCase/Shell/StatsShellTest.php M tests/TestCase/View/Helper/ReportsHelperTest.php Log Message: ----------- Apply the coding standard 5 fixes The type hints sniff added a native type on the internal properties of the Report class that are nullable, restore the nullability so the JSON payload of a report can still be parsed without those keys. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 0cb4b0e675211d866b5049a033e6a447e85c4c84 https://github.com/phpmyadmin/error-reporting-server/commit/0cb4b0e675211d86... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M webroot/index.php D config/requirements.php Log Message: ----------- Remove the platform requirements check config/requirements.php was added in 63645696ab and still checked for PHP 5.6. The CakePHP 5 app skeleton does not ship it anymore: the platform requirements are declared in composer.json and enforced by composer. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: ad9616955e316e16ebd40c6358e769f2a695d4d9 https://github.com/phpmyadmin/error-reporting-server/commit/ad9616955e316e16... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M .gitignore M phpunit.xml.dist Log Message: ----------- Update the phpunit configuration to the version 10+ schema The file from 989499ab56 uses the pre PHPUnit 10 schema and its listener pointed to Cake\TestSuite\Fixture\FixtureInjector, a class that no longer exists in CakePHP 5. Take the configuration of the CakePHP app skeleton, which registers the fixture extension, and keep the clover and junit reports the project generates. Ignore the .phpunit.cache directory PHPUnit writes with this version instead of the .phpunit.result.cache file. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 00f553761149d0cb795e620008af557a32b135b6 https://github.com/phpmyadmin/error-reporting-server/commit/00f553761149d0cb... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: A tests/TestCase/Command/CleanOldNotifsCommandTest.php A tests/TestCase/Command/StatsCommandTest.php A tests/TestCase/Command/SyncGithubIssueStatesCommandTest.php D tests/TestCase/Shell/CleanOldNotifsShellTest.php D tests/TestCase/Shell/StatsShellTest.php D tests/TestCase/Shell/SyncGithubIssueStatesShellTest.php Log Message: ----------- Rename the shell tests to command tests The tested classes are commands since b78fba7fc1, the tests kept the cake 2 shell naming of cc99382cdc. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 14b07acbe536b40a9deccb800269970e312331c3 https://github.com/phpmyadmin/error-reporting-server/commit/14b07acbe536b40a... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M .gitattributes Log Message: ----------- Sync the .gitattributes with the CakePHP app skeleton The file from 083ff72bc4 listed phpstan.xml.dist which does not exist, it is phpstan.neon.dist. Take the line endings and binary rules of the skeleton and keep the list of the files that should not be shipped in the archives. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 3286ea1fe7bd38481ce9e167980473787058740c https://github.com/phpmyadmin/error-reporting-server/commit/3286ea1fe7bd3848... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M composer.json Log Message: ----------- Run the static analysis as part of the check script phpstan was only run by the lint-and-analyse-php.yml workflow of 1cf0bd802e, the check script ran the tests and the coding standard only, so a local check could pass with static analysis errors. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: cff37d9b06db96495e1474a75f33ffd891d77367 https://github.com/phpmyadmin/error-reporting-server/commit/cff37d9b06db9649... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M phpstan-baseline.neon M src/Controller/DevelopersController.php M src/Report.php Log Message: ----------- Do not store the developer id on the table instance authenticateDeveloper() set the id of the developer on the table, a property that does not exist since the CakePHP 3 rewrite of 6aa5001d70, and the value was only used right after being computed. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 4dd52d5a0bf75beafceac5191e1ebdd0a1cacb85 https://github.com/phpmyadmin/error-reporting-server/commit/4dd52d5a0bf75bea... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M phpstan-baseline.neon M src/Command/StatsCommand.php M src/Controller/IncidentsController.php M src/Controller/ReportsController.php M src/Controller/StatsController.php M src/Model/Table/ReportsTable.php M tests/TestCase/Controller/IncidentsControllerTest.php M tests/TestCase/Controller/ReportsControllerTest.php M tests/TestCase/Model/Table/ReportsTableTest.php Log Message: ----------- Pass the report id to the reports table methods f52f639575 made the reports table methods read $this->id, a hidden state that breaks as soon as two reports are handled by the same request: pass the id as an argument instead. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 45d593d7f78bfa4eff5f73199d3b6c4bdd6447a3 https://github.com/phpmyadmin/error-reporting-server/commit/45d593d7f78bfa4e... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M phpstan-baseline.neon M src/Model/Table/ReportsTable.php Log Message: ----------- Remove the CakePHP 2 leftovers from the reports table The $hasMany, $validate and $findMethods properties date back to 6aa5001d70, they are not read by CakePHP 5: the association is declared in initialize() since the CakePHP 3 rewrite. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 88eb00478769f7de2e2cc0ce1fb57fba39020be9 https://github.com/phpmyadmin/error-reporting-server/commit/88eb00478769f7de... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M tests/TestCase/Model/Table/ReportsTableTest.php Log Message: ----------- Make the related reports test work again The test was marked incomplete in 61dc7e748a because it used the cake 2 read() call to change the report under test, set the relation with a query instead. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 2b0233ab2df905fd6f6a0f6dd21eed7054b57a48 https://github.com/phpmyadmin/error-reporting-server/commit/2b0233ab2df905fd... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M config/bootstrap.php Log Message: ----------- Use the error handling of the bootstrap shipped by cake The catch block written in 159dc3871d diverges from the skeleton of the CakePHP app: exit() with a string reports a success exit code and the message is never logged. Take the skeleton version, it writes the message where it can be read and exits with an error code. The mobile and tablet detectors of the skeleton are kept, mobiledetect is required by composer.json. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: bf192fd544a168fa4adb70b53e009be88cf584f1 https://github.com/phpmyadmin/error-reporting-server/commit/bf192fd544a168fa... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M README.md D config/app_example.php Log Message: ----------- Remove the duplicate app_example.php configuration file app_example.php was added in 8fcf478b82 and never received the environment driven settings of app.default.php (6aa5001d70). The README of b170f22458 pointed at it and f9796eb128 worked around the copy of the wrong file. Keep the up to date file only and point the README at it. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: bd90bcd44b178556d51947a157ba7e1082ded312 https://github.com/phpmyadmin/error-reporting-server/commit/bd90bcd44b178556... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M src/Console/Installer.php Log Message: ----------- Fix the configuration file the installer creates b2c531cfd8 stopped the salt setup when config/app_local.php is missing, but this project ships config/app.default.php and generates config/app.php from it, so the installer never created anything. Take the installer of the CakePHP app skeleton and point it at the files this project has, keeping the template existence guard of b2c531cfd8. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 6a3d75c16615b9c41c42129b9d814b2df1c49395 https://github.com/phpmyadmin/error-reporting-server/commit/6a3d75c16615b9c4... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M .github/workflows/tests.yml Log Message: ----------- Update the GitHub actions versions c38fb65096 pinned actions/checkout v6 and actions/cache v5, and ignored the PHP platform requirements of composer.json. Bump the actions to their current major version and key the Composer cache on composer.json and the PHP version instead of a static key. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: c8524257d81544c9fb5ef7a270172790094a94a4 https://github.com/phpmyadmin/error-reporting-server/commit/c8524257d81544c9... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M .github/workflows/tests.yml Log Message: ----------- Test the CI against the MariaDB version of Debian trixie The server runs PHP 8.4.27 and the MariaDB packaged in Debian 13 trixie, 11.8. The matrix of c38fb65096 uses MySQL 5.7, which is end of life since October 2023 and is not what the reports are stored in. Test the mariadb:11.8 image and install the intl extension that composer.json requires. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 8d8f73a2baec19197017f97e7893b2a7c1c1c3eb https://github.com/phpmyadmin/error-reporting-server/commit/8d8f73a2baec1919... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M README.md Log Message: ----------- Update the README requirements and test instructions The requirements still ask for the cake 3.0 extensions and the test instructions mention the /test.php webrunner, which was removed with the CakePHP 5 upgrade. Document the coding standard and static analysis commands added in 3286ea1fe7. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 12af5b85775b9d12277ba47b802e541cd51fd621 https://github.com/phpmyadmin/error-reporting-server/commit/12af5b85775b9d12... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M README.md Log Message: ----------- Remove the obsolete shell instructions from the README The addHashesToOldRecords shell documented in c8a367c872 does not exist anymore and the commands moved to src/Command in b78fba7fc1, the webrunner sentence comes from 5324e88736. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: b3c48c9928fa669d8b23abcec9bb9fd46ba3a535 https://github.com/phpmyadmin/error-reporting-server/commit/b3c48c9928fa669d... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: D .jshintrc D webroot/css/cake.generic.css D webroot/img/cake.icon.png D webroot/img/cake.power.gif D webroot/img/test-error-icon.png D webroot/img/test-fail-icon.png D webroot/img/test-pass-icon.png D webroot/img/test-skip-icon.png Log Message: ----------- Remove the unused CakePHP skeleton assets cake.generic.css and the cake icons came with the application skeleton in 6aa5001d70, the phpunit webrunner icons are served by a test.php that does not exist anymore and .jshintrc from a0419b3b0a is not used since there is no javascript lint in the CI. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: dc3f00f7eec1b430f04b27e25106737ce5621be1 https://github.com/phpmyadmin/error-reporting-server/commit/dc3f00f7eec1b430... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: A tests/TestCase/Controller/Component/OrderSearchComponentTest.php M src/Controller/Component/OrderSearchComponent.php Log Message: ----------- security: Do not inject the data tables sort direction into the query sSortDir_0 is taken from the query string and appended to the ORDER BY clause of the query, which the query builder does not escape, so a value like "ASC, (SLEEP(5))" was executed by the database. The column itself is safe, it is picked from the $aColumns list of 4725d7b296. Only ASC and DESC can be sent by DataTables, anything else is now read as ASC. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 501ee1e658c353cc557cb7ee604956767072243a https://github.com/phpmyadmin/error-reporting-server/commit/501ee1e658c353cc... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: A tests/TestCase/Controller/EventsSecurityTest.php M phpstan-baseline.neon M src/Controller/EventsController.php Log Message: ----------- security: Reject the webhook events that are not signed The signature check of b8a7a7f680 compared two empty strings when the X-Hub-Signature header was missing, so anybody could close any report by posting an issue event. An unknown algorithm such as "crc32b" made getHash() throw, which answered with a 500. Require a supported hash_hmac algorithm and a header with a hash, and compare in constant time with hash_equals(). Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: c96b5a31f33eaf0878d62703b5630bd58128a0fb https://github.com/phpmyadmin/error-reporting-server/commit/c96b5a31f33eaf08... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: A tests/TestCase/Controller/IncidentsXssTest.php A tests/TestCase/View/Helper/IncidentsHelperTest.php M src/View/Helper/IncidentsHelper.php M templates/Incidents/view.php Log Message: ----------- security: Escape the report fields printed by the incident page The values of a report come from the unauthenticated create endpoint of 6aa5001d70 and were printed as HTML in templates/Incidents/view.php since b37b319852. A report with <script>alert("xss")</script> as error message was executed in the session of the developer who opened it. Escape the values, including the description and the microhistory block, and the stack levels that IncidentsHelper concatenates. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 25f64143eea194212fb83d5a83a07dd053e60fff https://github.com/phpmyadmin/error-reporting-server/commit/25f64143eea19421... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M src/View/Helper/ReportsHelper.php M templates/Reports/view.php M tests/TestCase/View/Helper/ReportsHelperTest.php Log Message: ----------- security: Escape the report fields of the report page and its charts The report page printed the fields of the report and of its first incident unescaped since b37b319852, and the chart data built by getChartArray() and getLineChartData() was encoded with JSON_UNESCAPED_SLASHES, so a label containing </script> closed the script element the JSON is printed in. Escape the fields and encode the chart data with the JSON_HEX_ flags. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr> Commit: 9c128f27b512d2b156835109cddd9f7cd0bc2603 https://github.com/phpmyadmin/error-reporting-server/commit/9c128f27b512d2b1... Author: William Desportes <williamdes@wdes.fr> Date: 2026-10-27 (Tue, 10 October 2026) +01:00 Changed paths: M templates/layout/default.php Log Message: ----------- security: Escape the developer name in the header The full name comes from the GitHub API response stored at login and was printed unescaped in the header of every page since b37b319852. Co-authored-by: DeepSeek <noreply@deepseek.com> Signed-off-by: William Desportes <williamdes@wdes.fr>