From 80f48b084af874fea52ed29f06a1337954b137bf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 21 Jul 2009 13:02:20 -0700
Subject: In the logout link, urlencode the continue url so that ampersands,
 etc don't break encapsulation.  In the logout controller, don't run the url
 through url::redirect because that uses url::site().  Just set the Location
 header directly.

This fixes ticket #483.
---
 modules/user/views/login.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/user/views')

diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php
index 42bff4da..10ed31b2 100644
--- a/modules/user/views/login.html.php
+++ b/modules/user/views/login.html.php
@@ -15,7 +15,7 @@
       p::clean($user->display_name()) . '</a>')) ?>
   </li>
   <li>
-    <a href="<?= url::site("logout?csrf=$csrf&amp;continue=" . url::current(true)) ?>"
+    <a href="<?= url::site("logout?csrf=$csrf&amp;continue=" . urlencode(url::current(true))) ?>"
        id="gLogoutLink"><?= t("Logout") ?></a>
   </li>
   <? endif ?>
-- 
cgit v1.2.3