Index: lams_central/web/login.jsp
===================================================================
diff -u -r1e028ee473c0e56d3b6fe83f9db1f21103924086 -r4c67a2ae3d9ce7db7a06acd6ffca248e3f6e0937
--- lams_central/web/login.jsp	(.../login.jsp)	(revision 1e028ee473c0e56d3b6fe83f9db1f21103924086)
+++ lams_central/web/login.jsp	(.../login.jsp)	(revision 4c67a2ae3d9ce7db7a06acd6ffca248e3f6e0937)
@@ -39,6 +39,7 @@
 			<script type="text/javascript">
 				function submitForm() {
 					var password = $('#j_password').val();
+						
 					if (${encrypt}) {
 						$('#j_password').val(hex_sha1(password));
 					}
@@ -114,7 +115,7 @@
 								</div>
 							</c:if>
 							
-							<input type="hidden" name="redirectURL" value='${param.redirectURL}'/>
+							<input type="hidden" name="redirectURL" value='<c:out value="${param.redirectURL}" escapeXml="true" />' />
 							
 							<p class="first">
 								<fmt:message key="label.username" />
@@ -193,7 +194,7 @@
 				<form style="display: none" method="POST" action="j_security_check">
 					<input type="hidden" name="j_username" value="${login}" />
 					<input type="hidden" name="j_password" value="${password}" />
-					<input type="hidden" name="redirectURL" value="${param.redirectURL }" />
+					<input type="hidden" name="redirectURL" value='<c:out value="${param.redirectURL}" escapeXml="true" />' />
 				</form>
 			</div>
 			<div id="footer">
Index: lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java
===================================================================
diff -u -r39708e75f8c99f9488c91c5702b234317c0bccb4 -r4c67a2ae3d9ce7db7a06acd6ffca248e3f6e0937
--- lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java	(.../SsoHandler.java)	(revision 39708e75f8c99f9488c91c5702b234317c0bccb4)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java	(.../SsoHandler.java)	(revision 4c67a2ae3d9ce7db7a06acd6ffca248e3f6e0937)
@@ -34,6 +34,7 @@
 
 import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
 import org.apache.commons.lang.StringUtils;
@@ -80,9 +81,16 @@
 			// LoginRequestServlet (integrations) and LoginAsAction (sysadmin) set this parameter
 			String redirectURL = request.getParameter("redirectURL");
 			if (!StringUtils.isBlank(redirectURL)) {
+			    // prevent XSS attack
+			    if (redirectURL.contains("<")) {
+				HttpServletResponse response = (HttpServletResponse) context.getServletResponse();
+				response.sendError(HttpServletResponse.SC_BAD_REQUEST,
+					"redirectURL parameter contains HTML tags");
+				return;
+			    }
 			    SsoHandler.handleRedirectBack(context, redirectURL);
 			}
-			
+
 			/* Fetch UserDTO before completing request so putting it later in session is done ASAP
 			 * Response is sent in another thread and if UserDTO is not present in session when browser completes redirect,
 			 * it results in error. Winning this race is the easiest option.