Fixed another XSS issue: #1483830

18 years ago · bf0452585b
parent fda695f297
commit bf0452585b
1 changed files with 1 additions and 1 deletions
--- a/program/steps/mail/get.inc
+++ b/program/steps/mail/get.inc
@ -29,7 +29,7 @@ if ($_GET['_preload'])
  $message = rcube_label('loadingdata');
  print "<html>\n<head>\n" .
-        '<meta http-equiv="refresh" content="0; url='.$url.'">' .
+        '<meta http-equiv="refresh" content="0; url='.htmlspecialchars($url).'">' .
        "\n</head>\n<body>" .
        $message .
        "\n</body>\n</html>";