fixed xss bug

alixandru · Mar 16, 2016 · 09c4b6c · 09c4b6c
1 parent f7316b7
commit 09c4b6c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/qa-open-login.php b/qa-open-login.php
@@ -230,7 +230,7 @@ static function printCode($provider, $tourl, $context, $action = 'login', $print
 
 			$url = qa_path('login', $params, qa_path_to_root());
 			if(strlen($tourl) > 0) {
-				$url .= '&amp;to=' . $tourl; // play nice with validators
+				$url .= '&amp;to=' . htmlspecialchars($tourl); // play nice with validators
 			}
 			$classes = "$context action-login $zocial  $css";
 			$title = qa_lang_html_sub('plugin_open/login_using', $provider);