Patch by mark.
diffs (15 lines):
diff -r bd7785519454 -r 4ac600d84f6f cgi-bin/LJ/Widget/ImportChooseSource.pm
--- a/cgi-bin/LJ/Widget/ImportChooseSource.pm Sun May 10 02:31:23 2009 +0000
+++ b/cgi-bin/LJ/Widget/ImportChooseSource.pm Sun May 10 02:58:55 2009 +0000
@@ -98,7 +98,10 @@ sub handle_post {
return ( ret => $class->ml( 'widget.importchoosesource.error.nohostname' )
)
unless $hn;
- my $un = $post->{username};
+ # be sure to sanitize the username
+ my $un = lc $post->{username};
+ $un =~ s/-/_/g;
+
my $pw = $post->{password};
return ( ret => $class->ml(
'widget.importchoosesource.error.nocredentials' ) )
unless $un && $pw;
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
