Changeset 704 for trunk/phpbms/modules/bms/products_prereq.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/products_prereq.php (modified) (1 diff)

trunk/phpbms/modules/bms/products_prereq.php

@@ -132 +132 @@
 <?php $phpbms->showTabs("products entry","tab:9bfc7eea-5abb-f5d8-763f-f78fe499464d",$_GET["id"]);?><div class="bodyline">
         <h1><span><?php echo $pageTitle ?></span></h1>
-        <form action="<?php echo $_SERVER["REQUEST_URI"] ?>" method="post" name="record">
+        <form action="<?php echo htmlentities($_SERVER["REQUEST_URI"]) ?>" method="post" name="record">
         <input id="deleteid" name="deleteid" type="hidden" value="0" />
         <input id="command" name="command" type="hidden" value="" />