Fix for bug 95535: the token generator for password resets is allowing the & character to be used for tokens, but wasn't escaping them for the URL it emailed to users to use to get in to reset their password.

Patch by Dave Miller <justdave@syndicomm.com>
r= myk@mozilla.org

1 files changed, 1 insertions, 0 deletions

diff --git a/Token.pm b/Token.pm
index cde97f87e..2d5dad2a3 100644
--- a/Token.pm
+++ b/Token.pm
@@ -100,6 +100,7 @@ sub MailPasswordToken {
 
     my $urlbase = &::Param("urlbase");
     my $emailsuffix = &::Param('emailsuffix');
+    $token = &::url_quote($token);
 
     open SENDMAIL, "|/usr/lib/sendmail -t";