Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.611.2.9
diff -u -F^f -r1.611.2.9 common.inc
--- includes/common.inc	26 Jul 2007 19:16:45 -0000	1.611.2.9
+++ includes/common.inc	17 Oct 2007 19:28:03 -0000
@@ -267,10 +267,6 @@ function drupal_get_destination() {
  * 'user login'-block in a sidebar. The function drupal_get_destination()
  * can be used to help set the destination URL.
  *
- * It is advised to use drupal_goto() instead of PHP's header(), because
- * drupal_goto() will append the user's session ID to the URI when PHP is
- * compiled with "--enable-trans-sid".
- *
  * This function ends the request; use it rather than a print theme('page')
  * statement in your menu callback.
  *
@@ -302,6 +298,8 @@ function drupal_goto($path = '', $query 
   }
 
   $url = url($path, $query, $fragment, TRUE);
+  // Remove newlines from the URL to avoid header injection attacks.
+  $url = str_replace(array("\n", "\r"), '', $url);
 
   // Before the redirect, allow modules to react to the end of the page request.
   module_invoke_all('exit', $url);