tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-01 21:58:51 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #35 from silverstripe-security/patch/3.1/ss-2016-016

Browse Source 
[SS-2016-016] FIX Properly escape backURL for template injection
This commit is contained in:
Daniel Hensby 2016-11-15 11:11:38 +00:00 committed by GitHub
commit 6b123fe1c9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/CMSSecurity.php
View File

@ -204,7 +204,7 @@ PHP
'<p>Login success. If you are not automatically redirected '.
'<a target="_top" href="{link}">click here</a></p>',
'Login message displayed in the cms popup once a user has re-authenticated themselves',
array('link' => $backURL)
array('link' => Convert::raw2att($backURL))
)
));