From ae77e63d8205d97c8edf24128dddd0dea4d7dda1 Mon Sep 17 00:00:00 2001
From: Hivert Quentin <quentin.hivert.fr@gmail.com>
Date: Wed, 11 Nov 2026 19:36:41 +0100
Subject: [PATCH] #3127 properly parse the theme query

---
 UI/MainUI/SOGoRootPage.m             | 15 +++++++++++++++
 UI/SOGoUI/UIxComponent.m             |  3 +++
 UI/Templates/MainUI/SOGoRootPage.wox |  2 +-
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m
index 928e5d4e3..4e91e91b6 100644
--- a/UI/MainUI/SOGoRootPage.m
+++ b/UI/MainUI/SOGoRootPage.m
@@ -107,6 +107,21 @@ static const NSString *kJwtKey = @"jwt";
   return cookieLogin;
 }
 
+/* JavaScript string literal of the cookie username, safe to write inside a
+   <script> element: '<', '>' and '&' are escaped so the value can't close
+   the element. */
+- (NSString *) cookieUsernameAsJSString
+{
+  NSString *value;
+
+  value = [[self cookieUsername] doubleQuotedString];
+  value = [value stringByReplacingString: @"<" withString: @"\\u003c"];
+  value = [value stringByReplacingString: @">" withString: @"\\u003e"];
+  value = [value stringByReplacingString: @"&" withString: @"\\u0026"];
+
+  return value;
+}
+
 - (BOOL) rememberLogin
 {
   return ([[self cookieUsername] length]);
diff --git a/UI/SOGoUI/UIxComponent.m b/UI/SOGoUI/UIxComponent.m
index bf73a4134..bb2a99ab7 100644
--- a/UI/SOGoUI/UIxComponent.m
+++ b/UI/SOGoUI/UIxComponent.m
@@ -745,6 +745,9 @@ static SoProduct      *commonProduct      = nil;
   theme = [[context request] formValueForKey: @"theme"];
   if ([theme length])
     {
+      // The value is decoded: encode it again so that it can't inject
+      // characters (eg. CR/LF) into the Location header
+      theme = [theme stringByEscapingURL];
       url = [NSURL URLWithString: newLocation];
       query = [url query];
       if ([query length])
diff --git a/UI/Templates/MainUI/SOGoRootPage.wox b/UI/Templates/MainUI/SOGoRootPage.wox
index ae5f5ba5d..e72c7bc73 100644
--- a/UI/Templates/MainUI/SOGoRootPage.wox
+++ b/UI/Templates/MainUI/SOGoRootPage.wox
@@ -10,7 +10,7 @@
     const:jsFiles="Main.js, Common.js"
     >
   <script type="text/javascript" var:nonce="cspNonce">
-    var cookieUsername = <var:string var:value="cookieUsername.doubleQuotedString" const:escapeHTML="NO"/>;
+    var cookieUsername = <var:string var:value="cookieUsernameAsJSString" const:escapeHTML="NO"/>;
     var language = '<var:string var:value="language" const:escapeHTML="NO"/>';
     var loginHint = '<var:string var:value="getLoginHint" const:escapeHTML="NO"/>'
   </script>