Changeset 704 for trunk/phpbms/index.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/index.php (modified) (3 diffs)

trunk/phpbms/index.php

@@ -38 +38 @@
 */
         require_once("include/session.php");
+
+
         require_once("include/login_include.php");
 
@@ -52 +54 @@
 
         }//endif
+
+
+        if(isset($_SESSION["userinfo"]))
+            goURL(DEFAULT_LOAD_PAGE);
 
         $pageTitle = formatVariable(APPLICATION_NAME)." Log in";
@@ -74 +80 @@
                 </noscript>
 
-                <form name="form1" method="post" action="<?php echo $_SERVER["PHP_SELF"]?>">
+                <form name="form1" method="post" action="<?php echo htmlentities($_SERVER["PHP_SELF"])?>">
 
                         <p>