From 8ec4c7f3b0eebb76d9df4b884525c547028a0953 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 3 May 2022 10:33:28 +0200 Subject: [PATCH] Fixed XSS issue in login form. fix #2501 --- modoboa/core/views/auth.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modoboa/core/views/auth.py b/modoboa/core/views/auth.py index 75a14929f..e43ac2bf3 100644 --- a/modoboa/core/views/auth.py +++ b/modoboa/core/views/auth.py @@ -10,6 +10,7 @@ from django.template.loader import render_to_string from django.urls import reverse from django.utils import translation from django.utils.encoding import force_bytes +from django.utils.html import escape from django.utils.http import urlsafe_base64_encode from django.utils.translation import ugettext as _ from django.views import generic @@ -98,7 +99,7 @@ def dologin(request): logger.warning( "Failed connection attempt from '%(addr)s' as user '%(user)s'" % {"addr": request.META["REMOTE_ADDR"], - "user": form.cleaned_data["username"]} + "user": escape(form.cleaned_data["username"])} ) nextlocation = request.POST.get("next", "")