-
-
Notifications
You must be signed in to change notification settings - Fork 365
Closed
Description
Description
When embedding the base64-encoded $_GET['next'] parameter in the login form action attribute in front/index.php, the + character from base64 encoding can be misinterpreted as a space during URL parsing.
Suggested Fix
Apply urlencode() before htmlspecialchars() when building the form action:
?next=' . htmlspecialchars(urlencode($_GET['next']), ENT_QUOTES, 'UTF-8')This ensures the base64 value survives the round-trip through query string parsing.
Context
- File:
front/index.php(form action around line 193) - Original PR: Next release - deep link support after log in and refactor of index.php #1500
- Comment thread: Next release - deep link support after log in and refactor of index.php #1500 (comment)
- Requested by: @adamoutler
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels