From 17097a4d11274b157eadf64f32708acef204d510 Mon Sep 17 00:00:00 2001
From: Daniel Hensby <dhensby@silverstripe.com>
Date: Thu, 27 Oct 2016 16:03:25 +0100
Subject: [PATCH] [SS-2016-016] FIX Properly escape backURL for template
 injection

---
 security/CMSSecurity.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/CMSSecurity.php b/security/CMSSecurity.php
index 545111ed5..e34efb7df 100644
--- a/security/CMSSecurity.php
+++ b/security/CMSSecurity.php
@@ -204,7 +204,7 @@ PHP
 				'<p>Login success. If you are not automatically redirected '.
 				'<a target="_top" href="{link}">click here</a></p>',
 				'Login message displayed in the cms popup once a user has re-authenticated themselves',
-				array('link' => $backURL)
+				array('link' => Convert::raw2att($backURL))
 			)
 		));