nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-20 16:56:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Allow "&'<> in passwords.

Browse Source 
We had already allowed these when changing a password, but they were
being escaped when logging in. Closes #259.
This commit is contained in:
Andrew Ruthven 2022-02-12 23:48:50 +13:00
parent 8096807c6d
commit 5d56f6b5ea
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
inc/always.php.in
View File

@ -10,7 +10,7 @@ if ( preg_match('{/always.php$}', $_SERVER['SCRIPT_NAME'] ) ) header('Location:
// XSS Protection
function filter_post(&$val, $index) {
if(in_array($index, ["newpass1", "newpass2"])) return;
if(in_array($index, ["newpass1", "newpass2", "password"])) return;
switch (gettype($val)) {
case "string":