Changeset 5990 for trunk/identification.php

Timestamp:

Apr 29, 2010, 12:44:30 PM (14 years ago)

Author:

plg

Message:

bug 1484: prevent XSS vulnerability, encode url.

improvement: no need to transmit the REQUEST_URI from PHP, Smarty already
knows it.

File:

• trunk/identification.php (modified) (1 diff)

trunk/identification.php

@@ -55 +55 @@
   else
   { 
-    $redirect_to = isset($_POST['redirect']) ? $_POST['redirect'] : '';
+    $redirect_to = isset($_POST['redirect']) ? urldecode($_POST['redirect']) : '';
     $remember_me = isset($_POST['remember_me']) and $_POST['remember_me']==1;
     if ( try_log_user($_POST['username'], $_POST['password'], $remember_me) )