#
# Security fix for  XSS in web adminstration interface in login.php's p=... (#1292)
# Licensed under the GPLv2
# Olivier Bilodeau <obilodeau@inverse.ca>
#
# patch "pf/html/admin/login.php"
#  from [989515acaf10ac0046e08337fbfa6850136fe8e4]
#    to [437daaaf2a52b935008754acd28d6b71d1d33220]
#
============================================================
--- pf/html/admin/login.php	989515acaf10ac0046e08337fbfa6850136fe8e4
+++ pf/html/admin/login.php	437daaaf2a52b935008754acd28d6b71d1d33220
@@ -328,7 +328,7 @@ else {
 <div id="content">
 
 <div id="login" align=center>
-  <form method="post" name="login" action="<? print "$_SERVER[PHP_SELF]?p=" . (array_key_exists('p', $_GET) ? $_GET['p'] :'');?>">
+  <form method="post" name="login" action="<? print "$_SERVER[PHP_SELF]?p=" . (array_key_exists('p', $_GET) ? htmlentities($_GET['p']) :'');?>">
   <table>
     <tbody>
     <tr>