Add validation to avoid XSS in the login page

2013-01-03 09:25:44 -04:00
parent e63be38c87
commit 1f80c0f164
1 changed files with 1 additions and 1 deletions
--- a/workflow/engine/methods/login/login.php
+++ b/workflow/engine/methods/login/login.php
@@ -28,7 +28,7 @@ $aFields = array();
 if (!isset($_GET['u'])) {
    $aFields['URL'] = '';
 } else {
-    $aFields['URL'] = urldecode($_GET['u']);
+    $aFields['URL'] = urldecode(htmlentities($_GET['u']));
 }

 if (!isset($_SESSION['G_MESSAGE'])) {