From: Robin Appelman <icewind@owncloud.com>
Date: Sat, 31 Mar 2012 22:55:12 +0000 (+0200)
Subject: prevent an possible xss exploit
X-Git-Tag: v4.0.0beta~388^2~1
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=d01b78a4b486860ab7110677e9969a37ee2a832f;p=nextcloud-server.git

prevent an possible xss exploit
---

diff --git a/core/templates/login.php b/core/templates/login.php
index 82222c82129..4ba92221a7d 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -7,7 +7,7 @@
 		<?php endif; ?>
 		<p class="infield">
 			<label for="user" class="infield"><?php echo $l->t( 'Username' ); ?></label>
-			<input type="text" name="user" id="user" value="<?php echo !empty($_POST['user'])?$_POST['user'].'"':'" autofocus'; ?> autocomplete="off" required />
+			<input type="text" name="user" id="user" value="<?php echo !empty($_POST['user'])?htmlentities($_POST['user']).'"':'" autofocus'; ?> autocomplete="off" required />
 		</p>
 		<p class="infield">
 			<label for="password" class="infield"><?php echo $l->t( 'Password' ); ?></label>