7959 2012-10-10 06:28:00 -0700 login source parameter should remain within OJS context 2012-10-10 06:28:57 -0700 1 1 1 Unclassified OJS Framework 2.4.x All All NEW P3 normal --- 1 jason.nugent pkp-support 31753 jason.nugent 2012-10-10 06:28:57 -0700 It is currently possible to pass a fully qualified URL as the 'source' parameter, to be performed as a redirect once login occurs. This parameter should be sanitized to only allow redirection to pages or components within the OJS installation.