From: lpsolit%gmail.com <>
Date: Tue, 21 Feb 2006 08:24:51 +0000 (+0000)
Subject: [SECURITY] Bug 325079: The login form on the Bugzilla home page may redirect your... 
X-Git-Tag: bugzilla-2.20.1~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2cc608ea830f890b4d2191398166c7d1da82b568;p=thirdparty%2Fbugzilla.git

[SECURITY] Bug 325079: The login form on the Bugzilla home page may redirect your login and password to another site - Patch by Frédéric Buclin <LpSolit@gmail.com> r=myk a=justdave
---

diff --git a/template/en/default/account/auth/login-small.html.tmpl b/template/en/default/account/auth/login-small.html.tmpl
index 85802a7710..a6e3b6ddb6 100644
--- a/template/en/default/account/auth/login-small.html.tmpl
+++ b/template/en/default/account/auth/login-small.html.tmpl
@@ -21,7 +21,19 @@
 
 [% PROCESS global/variables.none.tmpl %]
 
-<form name="login" action="[% cgi.script_name FILTER html %]" method="POST">
+[%# Use the current script name. If an empty name is retuned,
+  # then we are accessing the home page. %]
+
+[% script_name = cgi.url(Relative => 1) %]
+
+[%# If SSL is in use, use 'sslbase', else use 'urlbase'. %]
+[% IF Param("sslbase") != "" && Param("ssl") != "never" %]
+  [% script_name = Param("sslbase") _ script_name %]
+[% ELSE %]
+  [% script_name = Param("urlbase") _ script_name %]
+[% END %]
+
+<form name="login" action="[% script_name FILTER html %]" method="POST">
   <table>
     <tr>
       <td align="right"><b>Login:</b></td>