Am 02.01.2010 15:58, schrieb Steffen Kamper: > Solution: > When returnUrl exist make the redirect. -1 from me as member of the Security Team because this introduces XSS! PoC would be &returnUrl=javascript:alert(123) Georg