Encode the target path in the login form.

contao · Dec 12, 2017 · 975070e · 975070e
1 parent 94916b8
commit 975070e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Resources/contao/templates/modules/mod_login.html5 b/src/Resources/contao/templates/modules/mod_login.html5
@@ -14,7 +14,7 @@
       <input type="hidden" name="FORM_SUBMIT" value="<?= $this->formId ?>">
       <input type="hidden" name="REQUEST_TOKEN" value="{{request_token}}">
       <?php if ($this->targetPath): ?>
-        <input type="hidden" name="<?= $this->targetName ?>" value="<?= $this->targetPath ?>">
+        <input type="hidden" name="<?= $this->targetName ?>" value="<?= StringUtil::specialchars($this->targetPath) ?>">
       <?php endif; ?>
       <?php if ($this->logout): ?>
         <p class="login_info"><?= $this->loggedInAs ?><br><?= $this->lastLogin ?></p>