Issue 2136& Automatically inserted error return url should not contain some characters. Variables need to be processed by HTMLSPECIALCHARS function.

git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.0@10868 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
misol 2012-07-11 15:44:26 +00:00
parent 91c8acdbb8
commit cb1188a542

View file

@ -272,7 +272,7 @@ class TemplateHandler {
if(!preg_match('/no-error-return-url="true"/i', $matches[1]))
{
preg_match('/<input[^>]*name="error_return_url"[^>]*>/is', $matches[2], $m3);
if(!$m3[0]) $matches[2] = '<input type="hidden" name="error_return_url" value="<?php echo getRequestUriByServerEnviroment() ?>" />'.$matches[2];
if(!$m3[0]) $matches[2] = '<input type="hidden" name="error_return_url" value="<?php echo htmlspecialchars(getRequestUriByServerEnviroment()) ?>" />'.$matches[2];
}
else
{