From a5744c30f7d3f503d58fb9c71da8d06798b49d58 Mon Sep 17 00:00:00 2001
From: root <root@www.cacert.org>
Date: Sun, 1 Jul 2007 19:45:28 +0000
Subject: [PATCH] Fixed a XSS with the email address

---
 pages/index/4.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pages/index/4.php b/pages/index/4.php
index 88f81b5..3553f7f 100644
--- a/pages/index/4.php
+++ b/pages/index/4.php
@@ -31,7 +31,7 @@ h1 {font-size:1.9em;text-align:center;}
 <? if($_REQUEST['noauto'] == 1) { ?><input type="hidden" name="noauto" value="1"><? } ?>
 <h1><?=_("Login")?></h1>
 <p class='smalltext'><?=_("Warning! This site requires cookies to be enabled to ensure your privacy and security. This site uses session cookies to store temporary values to prevent people from copying and pasting the session ID to someone else exposing their account, personal details and identity theft as a result.")?></p>
-<label for="email"><?=_("Email Address")?>:</label><input type='text' name="email" value="<?=strip_tags($_REQUEST['email'])?>" /><br />
+<label for="email"><?=_("Email Address")?>:</label><input type='text' name="email" value="<?=htmlspecialchars(strip_tags($_REQUEST['email']))?>" /><br />
 <label for="pword"><?=_("Pass Phrase")?>:</label><input type='password' name='pword' /><br />
 <input type='submit' name="process" value="<?=_("Login")?>" /><br /><br />
 <a href='https://www.cacert.org/index.php?id=4'>Password Login</a> -