Changeset 704 for trunk/phpbms/modules/base/tabledefs_groupings.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/base/tabledefs_groupings.php (modified) (1 diff)

trunk/phpbms/modules/base/tabledefs_groupings.php

@@ -94 +94 @@
         <?php $groupings->showRecords($allRecords) ?>
 
-        <form action="<?php echo $_SERVER["PHP_SELF"]."?id=".$_GET["id"] ?>" method="post" name="record" onsubmit="return validateForm(this);">
+        <form action="<?php echo htmlentities($_SERVER["PHP_SELF"])."?id=".$_GET["id"] ?>" method="post" name="record" onsubmit="return validateForm(this);">
         <fieldset>
                 <legend><?php echo $action?></legend>