Here's the patch for D7 from the security team, to prevent someone from redirecting someone to evilhacker.com on login destination. Stock D6 is not vulnerable, but doesn't hurt to harden this up. Tagging accordingly.

Commit credit should go to chx, fago, greggles

Private tracker: #61499

CommentFileSizeAuthor
#1 user-action-external-1558464-1-test-only.patch973 bytesBerdir
#1 user-action-external-1558464-1.patch1.57 KBBerdir
sdo_61499_20_user_steal-D7-do-not-test.patch1.5 KBwebchick
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Berdir’s picture

Berdir
Primary language German
Location Switzerland
CreditAttribution: Berdir commented
Status: Active » Needs review
FileSize
user-action-external-1558464-1.patch1.57 KB
user-action-external-1558464-1-test-only.patch973 bytes

Re-rolled.

aspilicious’s picture

aspilicious CreditAttribution: aspilicious commented
Status: Needs review » Reviewed & tested by the community

Identical! :D

ciriticals--

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented
Status: Reviewed & tested by the community » Fixed

Excellent, thank you!

Committed and pushed to 8.x.

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

(not verified) CreditAttribution: commented
Issue summary: View changes

x