From d42017018f0a5673504c463eff3d0a7639b606d8 Mon Sep 17 00:00:00 2001
From: Eric Lippmann <eric.lippmann@netways.de>
Date: Fri, 30 Jan 2015 09:31:05 +0100
Subject: [PATCH] Return HTTP 403 in case a SecurityException was thrown

---
 application/controllers/ErrorController.php | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/application/controllers/ErrorController.php b/application/controllers/ErrorController.php
index 23051bd9a..0548b5c9c 100644
--- a/application/controllers/ErrorController.php
+++ b/application/controllers/ErrorController.php
@@ -1,12 +1,9 @@
 <?php
-// {{{ICINGA_LICENSE_HEADER}}}
-// {{{ICINGA_LICENSE_HEADER}}}
 
-// namespace Icinga\Application\Controllers;
-
-use Icinga\Application\Logger;
-use Icinga\Web\Controller\ActionController;
 use Icinga\Application\Icinga;
+use Icinga\Application\Logger;
+use Icinga\Security\SecurityException;
+use Icinga\Web\Controller\ActionController;
 
 /**
  * Application wide controller for displaying exceptions
@@ -44,6 +41,13 @@ class ErrorController extends ActionController
                 }
 
                 break;
+            case Zend_Controller_Plugin_ErrorHandler::EXCEPTION_OTHER:
+                if ($exception instanceof SecurityException) {
+                    $this->getResponse()->setHttpResponseCode(403);
+                    $this->view->message = $exception->getMessage();
+                    break;
+                }
+                // Move to default
             default:
                 $title = preg_replace('/\r?\n.*$/s', '', $exception->getMessage());
                 $this->getResponse()->setHttpResponseCode(500);