Changeset 704 for trunk/phpbms/modules/bms/clients_addresses.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/clients_addresses.php (modified) (2 diffs)

trunk/phpbms/modules/bms/clients_addresses.php

@@ -157 +157 @@
                 //record offset?
                 if(isset($_POST["offset"])) if($_POST["offset"]!="") $displayTable->recordoffset=$_POST["offset"];
-                
+
                 $displayTable->issueQuery();
 
@@ -171 +171 @@
                         <h1 id="h1Title"><?php echo $pageTitle?></h1>
 
-                        <form name="search" id="search" action="<?php echo str_replace("&", "&amp;" ,$_SERVER["REQUEST_URI"])?>" method="post" onsubmit="setSelIDs(this);return true;">
+                        <form name="search" id="search" action="<?php echo htmlentities($_SERVER["REQUEST_URI"])?>" method="post" onsubmit="setSelIDs(this);return true;">
                         <input name="command" id="reset" type="submit"/>
                         <input name="theids" id="theids" type="hidden"  />