Merge branch 'v0.8' into stable

3 files changed, 7 insertions, 7 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1340db56..51c60d4c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,13 +5,13 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
 
-## [v0.9.0](https://github.com/shaarli/Shaarli/releases/tag/v0.9.0) - UNPUBLISHED
+## [v0.8.5](https://github.com/shaarli/Shaarli/releases/tag/v0.8.5) - 2018-01-04
 
-### Added
+ **XSS vulnerability fixed. Please update.**
 
-### Changed
+### Security
+- Fix an XSS (cross-site-scripting) vulnerability in `index.php`
 
-### Fixed
 
 ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04
 ### Security
diff --git a/index.php b/index.php
index b4ccd1bd..6060bd9e 100644
--- a/index.php
+++ b/index.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Shaarli v0.8.4 - Shaare your links...
+ * Shaarli v0.8.5 - Shaare your links...
  *
  * The personal, minimalist, super-fast, database free, bookmarking service.
  *
@@ -459,7 +459,7 @@ if (isset($_POST['login']))
     else
     {
         ban_loginFailed($conf);
-        $redir = '&username='. $_POST['login'];
+        $redir = '&username='. urlencode($_POST['login']);
         if (isset($_GET['post'])) {
             $redir .= '&post=' . urlencode($_GET['post']);
             foreach (array('description', 'source', 'title') as $param) {
diff --git a/shaarli_version.php b/shaarli_version.php
index 1c1c5d74..a7b8799a 100644
--- a/shaarli_version.php
+++ b/shaarli_version.php
@@ -1 +1 @@
-<?php /* 0.8.4 */ ?>
+<?php /* 0.8.5 */ ?>