You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When embedding the base64-encoded $_GET['next'] parameter in the login form action attribute in front/index.php, the + character from base64 encoding can be misinterpreted as a space during URL parsing.
Suggested Fix
Apply urlencode() before htmlspecialchars() when building the form action:
Description
When embedding the base64-encoded
$_GET['next']parameter in the login form action attribute infront/index.php, the+character from base64 encoding can be misinterpreted as a space during URL parsing.Suggested Fix
Apply
urlencode()beforehtmlspecialchars()when building the form action:This ensures the base64 value survives the round-trip through query string parsing.
Context
front/index.php(form action around line 193)