Bug 7959

Summary:	login source parameter should remain within OJS context
Product:	OJS	Reporter:	Jason Nugent <jason.nugent>
Component:	Framework	Assignee:	PKP Support <pkp-support>
Status:	NEW ---
Severity:	normal
Priority:	P3
Version:	2.4.x
Hardware:	All
OS:	All
Version Reported In:		Also Affects:

Description Jason Nugent 2012-10-10 06:28:57 PDT

It is currently possible to pass a fully qualified URL as the 'source' parameter, to be performed as a redirect once login occurs.  This parameter should be sanitized to only allow redirection to pages or components within the OJS installation.