From e7487082c32de87efd756bf05ae8539d38cda373 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Thu, 29 Apr 2010 10:44:30 +0000
Subject: bug 1484: prevent XSS vulnerability, encode url.

improvement: no need to transmit the REQUEST_URI from PHP, Smarty already
knows it.

git-svn-id: http://piwigo.org/svn/trunk@5990 68402e56-0260-453c-a942-63ccdbb3a9ee
---
 themes/default/template/identification.tpl         | 2 +-
 themes/default/template/menubar_identification.tpl | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'themes/default')

diff --git a/themes/default/template/identification.tpl b/themes/default/template/identification.tpl
index 1541fd471..1a34744ac 100644
--- a/themes/default/template/identification.tpl
+++ b/themes/default/template/identification.tpl
@@ -21,7 +21,7 @@
   <fieldset>
     <legend>{'Connection settings'|@translate}</legend>
 
-    <input type="hidden" name="redirect" value="{$U_REDIRECT}">
+    <input type="hidden" name="redirect" value="{$U_REDIRECT|urlencode}">
 
     <ul>
       <li>
diff --git a/themes/default/template/menubar_identification.tpl b/themes/default/template/menubar_identification.tpl
index c0af6047d..b686b9601 100644
--- a/themes/default/template/menubar_identification.tpl
+++ b/themes/default/template/menubar_identification.tpl
@@ -28,7 +28,7 @@
 
 	{if isset($U_LOGIN)}
 	<form method="post" action="{$U_LOGIN}" id="quickconnect">
-        <input type="hidden" name="redirect" value="{$U_REDIRECT}">
+        <input type="hidden" name="redirect" value="{$smarty.server.REQUEST_URI|urlencode}">
 	<fieldset>
 	<legend>{'Quick connect'|@translate}</legend>
 	<div>
-- 
cgit v1.2.3