Changeset 704 for trunk/phpbms/modules/bms/invoices_addedit.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/invoices_addedit.php (modified) (1 diff)

trunk/phpbms/modules/bms/invoices_addedit.php

@@ -242 +242 @@
 
 
-?><form action="<?php echo str_replace("&","&amp;",$_SERVER["REQUEST_URI"]) ?>"
+?><form action="<?php echo htmlentities($_SERVER["REQUEST_URI"]) ?>"
         method="post" name="record" id="record"><div id="dontSubmit"><input type="submit" value=" " onclick="return false;" /></div>
 <?php $phpbms->showTabs("invoices entry","tab:20276b44-9cfa-403e-4c2a-ac6f0987ae20",$therecord["id"]);?><div class="bodyline">