cvs: docweb /www login.php

colder		Tue Dec  5 18:02:16 2006 UTC

  Modified files:              
    /docweb/www	login.php 
  Log:
  Restrict $_REQUEST["return"] to printable chars
  
http://cvs.php.net/viewvc.cgi/docweb/www/login.php?r1=1.3&r2=1.4&diff_format=u
Index: docweb/www/login.php
diff -u docweb/www/login.php:1.3 docweb/www/login.php:1.4
--- docweb/www/login.php:1.3	Tue Dec  5 17:53:15 2006
+++ docweb/www/login.php	Tue Dec  5 18:02:16 2006
@@ -1,5 +1,5 @@
 <?php
-/* $Id: login.php,v 1.3 2006/12/05 17:53:15 colder Exp $ */
+/* $Id: login.php,v 1.4 2006/12/05 18:02:16 colder Exp $ */
 
 include '../include/init.inc.php';
 
@@ -8,7 +8,7 @@
     auth();
         
     if (isset($_REQUEST['return']) && !empty($_REQUEST['return'])
-        && strpos($_REQUEST['return'], "\n") === false) {
+        && ctype_print($_REQUEST['return'])) {
 
         header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']);
     }