mirror of
https://github.com/zulip/zulip.git
synced 2025-11-01 20:44:04 +00:00
c85e00e02e
Had this been in normal route, this would have been an XSS bug, as we were passing what the developer clearly believed to be plain text into an HTML 404 page. The affected routes have @require_server_admin, a permission that we do not expect any self-hosted users to have ever enabled (as it is undocumented and doing so is only possible manually via a `manage.py shell`, and we believe to only be useful for running a SaaS service like zulip.com). So the security impact is limited to a handful of staff of zulip.com and this isn't a candidate for a CVE. Thanks to GitHub's CodeQL for finding this.