From 5d56f6b5ea7b8041b38e0e2dfaecd48e0f599a5c Mon Sep 17 00:00:00 2001
From: Andrew Ruthven <puck@catalyst.net.nz>
Date: Sat, 12 Feb 2022 23:48:50 +1300
Subject: [PATCH] Allow "&'<> in passwords.

We had already allowed these when changing a password, but they were
being escaped when logging in. Closes #259.
---
 inc/always.php.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/always.php.in b/inc/always.php.in
index cffdb7bb..28c08bdd 100644
--- a/inc/always.php.in
+++ b/inc/always.php.in
@@ -10,7 +10,7 @@ if ( preg_match('{/always.php$}', $_SERVER['SCRIPT_NAME'] ) ) header('Location:
 
 // XSS Protection
 function filter_post(&$val, $index) {
-    if(in_array($index, ["newpass1", "newpass2"])) return;
+    if(in_array($index, ["newpass1", "newpass2", "password"])) return;
 
     switch (gettype($val)) {
         case "string":