From fc536c349113694491a035fa400bd72e8fb99513 Mon Sep 17 00:00:00 2001
From: Michiel de Jong <michiel@unhosted.org>
Date: Fri, 18 May 2012 16:00:17 +0200
Subject: [PATCH] add htmlentities() call into login form
---
core/templates/login.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/core/templates/login.php b/core/templates/login.php
index a40bf5c330..41d6ba41ef 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -1,7 +1,7 @@
<!--[if IE 8]><style>input[type="checkbox"]{padding:0;}</style><![endif]-->
<form action="index.php" method="post">
<fieldset>
- <?php if(!empty($_['redirect'])) { echo '<input type="hidden" name="redirect_url" value="'.$_['redirect'].'" />'; } ?>
+ <?php if(!empty($_['redirect'])) { echo '<input type="hidden" name="redirect_url" value="'.htmlentities($_['redirect']).'" />'; } ?>
<?php if($_['error']): ?>
<a href="./core/lostpassword/"><?php echo $l->t('Lost your password?'); ?></a>
<?php endif; ?>
--
GitLab