closes #4997

9 years ago · e33dfe3c55
parent 4aac8bbe6a
commit e33dfe3c55
1 changed files with 1 additions and 1 deletions
--- a/src/controllers/index.js
+++ b/src/controllers/index.js
@ -109,7 +109,7 @@ Controllers.login = function(req, res, next) {
 	if (req.query.error === 'csrf-invalid') {
 		errorText = '[[error:csrf-invalid]]';
 	} else if (req.query.error) {
-		errorText = req.query.error;
+		errorText = validator.escape(req.query.error);
 	}

 	data.alternate_logins = loginStrategies.length > 0;