Changeset 704 for trunk/phpbms/modules/bms/receipts_addedit.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/receipts_addedit.php (modified) (2 diffs)

trunk/phpbms/modules/bms/receipts_addedit.php

@@ -47 +47 @@
                         $backurl .= "?refid=".$_GET["refid"];
         }
-        
+
         if(!isset($_GET["id"]))
                 $_GET["id"] = 0;
@@ -140 +140 @@
 
 ?><div class="bodyline">
-<form action="<?php echo str_replace("&", "&amp;", $_SERVER["REQUEST_URI"]) ?>" method="post" name="record" id="record">
+<form action="<?php echo htmlentities($_SERVER["REQUEST_URI"]) ?>" method="post" name="record" id="record">
 
         <div id="topButtons"><?php showSaveCancel(1); ?></div>