Fix XSS vulnerability

Signed-off-by: VirtualTam <virtualtam@flibidi.net>
shaarli · Jan 4, 2018 · aadec30 · aadec30
1 parent 8868f3c
commit aadec30
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/index.php b/index.php
@@ -459,7 +459,7 @@ function ban_canLogin($conf)
     else
     {
         ban_loginFailed($conf);
-        $redir = '&username='. $_POST['login'];
+        $redir = '&username='. urlencode($_POST['login']);
         if (isset($_GET['post'])) {
             $redir .= '&post=' . urlencode($_GET['post']);
             foreach (array('description', 'source', 'title') as $param) {