SID-00476: origurl, unvalidated hidden form field on the login page?

Status:	Unanswered	TWiki version:	4.2.0	Perl version:
Category:	CategorySecurity	Server OS:	Solaris	Last update:	16 years ago

I am running TWIki4.2 and was wondering has anyone else had a problem with the origurl hidden form field on the login page being unvalidated? Has this been corrected in any of the newer releases, i haven't seen any information about it anywhere? We get tested for vunerabilities (XSS was the main one in this case) and need to know if this can be fixed.

-- JohnAllen4 - 2009-08-11

Discussion and Answer

Closing this question after more than 30 days of inactivity. Feel free to reopen if needed. Consider engaging one of the TWiki consultants if you need timely help. We invite you to get involved with the community, it is more likely you get community support if you support the open source project!

-- PeterThoeny - 2009-10-02

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.