From e512b3d6cf18fd8f1fce4872d9f2b71adde2f78c Mon Sep 17 00:00:00 2001
From: Roland Becker <roland@atrol.de>
Date: Fri, 8 Jan 2021 10:46:26 +0100
Subject: [PATCH] Fix XSS in account_prof_edit_page.php

Fixes #27853
---
 account_prof_edit_page.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/account_prof_edit_page.php b/account_prof_edit_page.php
index 306da0f5c1..e26880a72c 100644
--- a/account_prof_edit_page.php
+++ b/account_prof_edit_page.php
@@ -96,7 +96,7 @@
 		<?php  echo form_security_field( 'account_prof_update' )?>
 		<input type="hidden" name="action" value="update" />
 		<input type="hidden" name="profile_id" value="<?php echo $v_id ?>" />
-		<input type="hidden" name="redirect" value="<?php echo $f_redirect_page ?>" />
+		<input type="hidden" name="redirect" value="<?php echo string_attribute( $f_redirect_page ) ?>" />
 
 		<div class="widget-box widget-color-blue2">