Changeset 704 for trunk/phpbms/include/imports.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/include/imports.php (modified) (1 diff)

trunk/phpbms/include/imports.php

@@ -457 +457 @@
                         function startForm($pageTitle, $pageType, $numberOfRecords = 0){
 
-                                ?><form action="<?php echo str_replace("&","&amp;",$this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" onsubmit="<?php echo $this->onsubmit?>" <?php
+                                ?><form action="<?php echo htmlentities($this->action) ?>" method="<?php echo $this->method?>" name="<?php echo $this->name?>" onsubmit="<?php echo $this->onsubmit?>" <?php
                                         if(isset($this->enctype)) echo ' enctype="'.$this->enctype.'" ';
                                         if(isset($this->id)) echo ' id="'.$this->id.'" ';