Changeset 704 for trunk/phpbms/modules/bms/report/aritems_clientstatement.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/report/aritems_clientstatement.php (modified) (1 diff)

trunk/phpbms/modules/bms/report/aritems_clientstatement.php

@@ -499 +499 @@
                 $phpbms->showMenu = false;
 
-                $formSubmit = str_replace("&","&",$_SERVER['REQUEST_URI']);
+                $formSubmit = htmlentities($_SERVER['REQUEST_URI']);
 
                 $theform = new phpbmsForm();