Question concerning login.jsp

[Cantor, Scott]

On 4/29/13 10:20 AM, "Brewer, Edward L" <lee.brewer at Vanderbilt.Edu> wrote:

>Thanks, that was the ticket.  Here is the solution to our problem
>
>In the login.jsp we included this javascript

Umm, I don't want to alarm you, but that looks like a XSS attack waiting
to happen. You shouldn't be controlling the form action with something
that can be fed in externally.

-- Scott