Thanks guys. I will definitely look into this XSS issue more before going live.
One more question I have though, I found that it worked fine when I was already logged into the community, but if I was redirected to the login page first it didn't work. Any thoughts on what I would have to do to get this working?
I have SSO turned on. Do I need to do anything to the field "URL to login page"? It looks like the query string is getting removed when I get redirected to the login page.
Thanks,
Jonathan
With SSO, Lithium redirects the user to an external URL (configured in Lithium admin). Lithium includes the URL of the original page (in the parameter return_url) so that the extenal site can redirect the user after they have logged in. However, the implementation of this is down to the external site.
It's hard to know for certain without seeing the site, but I suspect that at some point during the redirection, the extra parameters are getting stripped out of the URL (probably when the external site redirects the user back to the community).
If the user needs to be logged in to access the page with the iframe, it might be worth exploring the option of retrieving the email address from FreeMarker rather than the URL.
