Tickets :: Comment on [#14148] vacation, spam & forward double encoding

* Your Email Address
* Spam protection	Enter the letters below: .___. ..__ .__ __. [__ \|\ \|[__)[__)(__ [___\| \\|\| \\| \.__)
Comment	>> This isn't correct and opens a security issue in Horde_Form. We >> should probably rather make sure that we don't pass the encoded URL >> to Horde_Form from Ingo. Probably need to set ->raw in the passed >> Horde_Url. > > But it's not already encoded. What was removed was the "action" > attribute being run through htmlspecialchars, which isn't really > appropriate for encoding an actual URL. e.g.: > > htmlspecialchars('/some/page.php?foo=bar&bar=foo') > > does not result in a valid, working url.
Attachment
Watch this ticket