diff --git a/lib/Server.php b/lib/Server.php
index <HASH>..<HASH> 100644
--- a/lib/Server.php
+++ b/lib/Server.php
@@ -329,6 +329,12 @@ class sspmod_openidProvider_Server {
 	public function loadState($stateId) {
 		assert('is_string($stateId)');
 
+		// sanitize the input
+		$restartURL = SimpleSAML_Utilities::getURLFromStateID($stateId);
+		if (!is_null($restartURL)) {
+			SimpleSAML_Utilities::checkURLAllowed($restartURL);
+		}
+
 		return SimpleSAML_Auth_State::loadState($stateId, 'openidProvider:resumeState');
 	}
Followup on previous commits. Use redirectUntrustedURL() as a shortcut, and let everything else make use of redirectTrustedURL(). Move the responsibility to check the input out of the library, to the places where URLs are grabbed from input parameters.

git-svn-id: <URL>