CVE-2019-25095: LdapCherry Cross-site Scripting vulnerbaility

The vulnerability stems from two key patterns: 1) Use of base64 encoding (instead of URL-safe encoding) for user-controlled redirect URLs in _check_auth, which bypassed proper escaping. 2) Direct use of decoded URL parameters in login redirection without sanitization. The commit diff shows replacement of base64 with urllib.quote_plus and template escaping improvements, confirming these functions were the injection points. The templates' ${form} and ${roles} variables also lacked HTML escaping filters before the patch, but these are template-level issues rather than discrete functions.