--- cosign.module	2008-12-18 12:24:41.000000000 -0500
+++ cosign.module.patched	2010-09-01 14:18:23.020797669 -0400
@@ -100,7 +100,7 @@
     unset($form['name']);
     unset($form['pass']);
     unset($form['submit']);
-    $form['links']['#value'] = '<a href="https://' . $_SERVER['HTTP_HOST'] . request_uri() . '">Login</a>';
+    $form['links']['#value'] = '<a href="https://' . $_SERVER['HTTP_HOST'] . filter_xss(urldecode(request_uri()), array()) . '">Login</a>';
   }
 
   if ($form_id == "user_login") {