ilkon/Tank-Auth — Issue #6: xss_clean rule on password input mangles the password
Author: jayherb
Created: 2011-11-02 18:32:06+00:00
State: open

The xss_clean rule on the password field for signin and signup is causing password fields containing an ampersand to be altered and causing the match rule to fail. For example, "pass&word" will get changed to "pass&word;" (a semicolon added at the end)

xss_clean is not necessary for passwords anyway since they are hashed before storage?