HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / user / login.rhtml

diff --git a/app/views/user/login.rhtml b/app/views/user/login.rhtml
index 215385c36df4a87ae398e928139c26dcf7e8815d..5c6ec3ec5db92a5f6c78073d0536832cebe50383 100644 (file)
--- a/app/views/user/login.rhtml
+++ b/app/views/user/login.rhtml
@@ -2,7 +2,7 @@
 Please login or <%= link_to 'create an account', :controller => 'user', :action => 'new' %>.<br />
 
 <% form_tag :action => 'login' do %>
-<%= hidden_field_tag('referer', params[:referer]) %>
+<%= hidden_field_tag('referer', h(params[:referer])) %>
 <table>
   <tr><td>Email Address:</td><td><%= text_field('user', 'email',{:size => 50, :maxlength => 255}) %></td></tr>
   <tr><td>Password:</td><td><%= password_field('user', 'password',{:size => 50, :maxlength => 255}) %></td></tr>