Changeset 704 for trunk/phpbms/include

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Location:

trunk/phpbms/include

Files:

• fields.php (modified) (1 diff)
• imports.php (modified) (1 diff)
• search_class.php (modified) (2 diffs)

trunk/phpbms/include/fields.php

@@ -82 +82 @@
     function startForm($pageTitle){
 
-        ?><form action="<?php echo str_replace("&","&amp;",$this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" <?php
+        ?><form action="<?php echo htmlentities($this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" <?php
                 if($this->onsubmit !== NULL) { ?>onsubmit="<?php echo $this->onsubmit?>" <?php }
                 if(isset($this->enctype)) echo ' enctype="'.$this->enctype.'" ';

trunk/phpbms/include/imports.php

@@ -457 +457 @@
                         function startForm($pageTitle, $pageType, $numberOfRecords = 0){
 
-                                ?><form action="<?php echo str_replace("&","&amp;",$this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" onsubmit="<?php echo $this->onsubmit?>" <?php
+                                ?><form action="<?php echo htmlentities($this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" onsubmit="<?php echo $this->onsubmit?>" <?php
                                         if(isset($this->enctype)) echo ' enctype="'.$this->enctype.'" ';
                                         if(isset($this->id)) echo ' id="'.$this->id.'" ';

trunk/phpbms/include/search_class.php

@@ -304 +304 @@
                                  if($this->numrows==RECORD_LIMIT or $this->recordoffset!=0){
                                     //if you max the record limit or are already offsetiing get the true count
-                                        
+
                                         $truecountstatement = "
                                                 SELECT
@@ -587 +587 @@
 
                 ?>
-<form name="search" id="search" method="post" action="<?php echo $_SERVER["PHP_SELF"]?>?id=<?php echo $this->thetabledef["uuid"]?>" onsubmit="setSelIDs(this);return true;">
+<form name="search" id="search" method="post" action="<?php echo htmlentities($_SERVER["PHP_SELF"])?>?id=<?php echo $this->thetabledef["uuid"]?>" onsubmit="setSelIDs(this);return true;">
 <input id="tabledefid" name="tabledefid" type="hidden" value="<?php echo $this->thetabledef["id"]?>" />
 <input id="theids" name="theids" type="hidden" value="" />