Open Redirection issue finded by Netsparker, be very attentive!

I don't know how you -or that software- can say this module has such a vulnerability as this module does not accept any user input. Will never accept a GET request with a parameter containing a URL to trigger a redirect.

At most when javascript is not enabled this module accepts a POST request (a form submission) with the URL to redirect into a hidden field. I don't know how that can be exploited as if someone manages to exploit any other vulnerability on any other module or into drupal to inyect some javascript that triggers a fake POST request he could just as easily inyect javascript that triggers the redirect directly. So I'm totally unable to see any vulnerability in this module.

Anyway I have changed the way the module handles that fallback when javascript is disabled and now it just uses the language code as the POST parameter it accepts to make the redirect. So if that was the vulnerability reported it is already solved in new version.

If you still think there is such a vulnerability in this module report back with further explanation of the issue please.

If there were any issue this should be already fixed.