mirror of
https://github.com/Novaloop-AG/element-x-android.git
synced 2026-10-31 16:22:49 +00:00
hayaksi1
c901b902b1
The sanitize() helper applied to the login, password and account deactivation password fields promises to remove "any new line characters" but only removes LF. A value pasted from a source with CRLF endings keeps its CR, which is invisible in the field and is sent to the homeserver as part of the password, so the login is rejected while typing the same characters by hand works. Drop every line separator instead of LF only, in both copies of the helper. Whitespace that can legitimately be part of a password, such as spaces and tabs, is left untouched.