This was first noted elsewhere by @quicksketch but I'm posting a patch to fix it now.

The Redirect module calls urldecode() on data from $_GET before putting it in a form field. Per http://php.net/manual/en/function.urldecode.php that should never be necessary since data in $_GET is already decoded. Decoding it again can only lead to bugs. (In the general case, it can lead to security issues also, but when the security team discussed this we didn't think there was any security issue in this particular case.)

This patch is for Drupal 7. For Drupal 8, there are some urldecode() calls too, but it's not obvious to me if they should be removed or not.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

David_Rothstein created an issue. See original summary.

David_Rothstein’s picture

Status: Active » Needs review
FileSize
1.01 KB

Here is the patch.