SECURITY: Fix javascript injection vulnerability in mobile login page.

horde · Jun 14, 2020 · e554dad · e554dad
1 parent f1aacc7
commit e554dad
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/login.php b/login.php
@@ -347,6 +347,8 @@ function _addAnchor($url, $type, $vars, $url_anchor = null)
 if ($browser->isMobile() &&
     (!isset($conf['user']['force_view']) ||
      !in_array($conf['user']['force_view'], array('basic', 'dynamic')))) {
+
+    $loginparams['horde_user']['value'] = htmlspecialchars($loginparams['horde_user']['value']);
     $view = new Horde_View(array(
         'templatePath' => HORDE_TEMPLATES . '/login'
     ));