Changeset 5990


Ignore:
Timestamp:
Apr 29, 2010, 12:44:30 PM (10 years ago)
Author:
plg
Message:

bug 1484: prevent XSS vulnerability, encode url.

improvement: no need to transmit the REQUEST_URI from PHP, Smarty already
knows it.

Location:
trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/identification.php

    r5196 r5990  
    5555  else
    5656  {
    57     $redirect_to = isset($_POST['redirect']) ? $_POST['redirect'] : '';
     57    $redirect_to = isset($_POST['redirect']) ? urldecode($_POST['redirect']) : '';
    5858    $remember_me = isset($_POST['remember_me']) and $_POST['remember_me']==1;
    5959    if ( try_log_user($_POST['username'], $_POST['password'], $remember_me) )
  • trunk/include/block.class.php

    r5986 r5990  
    135135
    136136    $template->set_filename('menubar', $file);
    137     $template->assign(array('U_REDIRECT' => $_SERVER['REQUEST_URI']));
    138137    trigger_action('blockmanager_apply', array(&$this) );
    139138
  • trunk/themes/default/template/identification.tpl

    r5559 r5990  
    2222    <legend>{'Connection settings'|@translate}</legend>
    2323
    24     <input type="hidden" name="redirect" value="{$U_REDIRECT}">
     24    <input type="hidden" name="redirect" value="{$U_REDIRECT|urlencode}">
    2525
    2626    <ul>
  • trunk/themes/default/template/menubar_identification.tpl

    r5986 r5990  
    2929        {if isset($U_LOGIN)}
    3030        <form method="post" action="{$U_LOGIN}" id="quickconnect">
    31         <input type="hidden" name="redirect" value="{$U_REDIRECT}">
     31        <input type="hidden" name="redirect" value="{$smarty.server.REQUEST_URI|urlencode}">
    3232        <fieldset>
    3333        <legend>{'Quick connect'|@translate}</legend>
Note: See TracChangeset for help on using the changeset viewer.