From 8b3bdbb96a21417955b973a2f10013b4d053c33a Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Tue, 19 May 2026 19:37:34 +0200
Subject: [PATCH 1/2] 7259: Fixed admin toast leaking raw html error output

---
 CHANGELOG.md                                      |  2 ++
 .../util/list/toast-component/display-toast.jsx   | 15 ++++++++++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b7340f20..641f67178 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Fixed admin toast leaking a raw `SyntaxError: Unexpected token '<'` when an upload was rejected upstream (e.g. nginx 413); the toast now shows `HTTP <status>` instead.
+
 ## [3.0.0-rc3] - 2026-05-11
 
 - Made the Admin login sidebar text configurable via the new `ADMIN_LOGIN_SCREEN_TEXT`
diff --git a/assets/admin/components/util/list/toast-component/display-toast.jsx b/assets/admin/components/util/list/toast-component/display-toast.jsx
index ca7dec087..5154ab64a 100644
--- a/assets/admin/components/util/list/toast-component/display-toast.jsx
+++ b/assets/admin/components/util/list/toast-component/display-toast.jsx
@@ -27,10 +27,19 @@ export function displayError(errorString, error) {
   if (error && error["hydra:description"]) {
     errorText = error["hydra:description"];
   }
-  if (error && error.data) {
-    errorText = error.data["hydra:description"] || error.data.message;
+  if (error?.data && typeof error.data === "object") {
+    errorText = error.data["hydra:description"] || error.data.message || "";
   }
-  if (error && error.error) {
+  // RTK Query couldn't JSON-parse the response — typically an HTML error page
+  // from nginx/php-fpm rejecting the request before Symfony (e.g. 413 when the
+  // upload exceeds the proxy body-size limit). Show the HTTP status instead
+  // of leaking the "Unexpected token '<'" SyntaxError to the user.
+  if (!errorText && error?.status === "PARSING_ERROR") {
+    errorText = error.originalStatus
+      ? `HTTP ${error.originalStatus}`
+      : "Server returned an unexpected response";
+  }
+  if (!errorText && error?.error) {
     errorText = error.error;
   }
 

From 93f11ce3a606e9260b4df0322f138cf4c2b1690e Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Tue, 19 May 2026 21:26:36 +0200
Subject: [PATCH 2/2] 7259: Markdown lint

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 641f67178..8dc5e57fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-- Fixed admin toast leaking a raw `SyntaxError: Unexpected token '<'` when an upload was rejected upstream (e.g. nginx 413); the toast now shows `HTTP <status>` instead.
+- Fixed admin toast leaking a raw `SyntaxError: Unexpected token '<'` when an upload was rejected
+  upstream (e.g. nginx 413); the toast now shows `HTTP <status>` instead.
 
 ## [3.0.0-rc3] - 2026-05-11