Modified: web/php-master/trunk/manage/event.php
===================================================================
--- web/php-master/trunk/manage/event.php	2011-06-01 19:33:04 UTC (rev 311719)
+++ web/php-master/trunk/manage/event.php	2011-06-02 00:05:23 UTC (rev 311720)
@@ -2,6 +2,8 @@
 require '../include/login.inc';
 require '../include/email-validation.inc';

+define('PHP_SELF', htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'));
+
 $mailto = "php-webmaster@lists.php.net";
 #$mailto = "jimw@apache.org";

@@ -111,7 +113,7 @@

 if (isset($id)) {
 ?>
-<form action="<?php echo $PHP_SELF?>" method="post">
+<form action="<?php echo PHP_SELF?>" method="post">
 <input type="hidden" name="id" value="<?php echo $id?>" />
 <table bgcolor="#eeeeee" border="0" cellspacing="0" cellpadding="3" width="100%">
  <tr>
@@ -189,7 +191,7 @@
 </form>
 <table>
 <tr>
- <form method="get" action="<?php echo $PHP_SELF;?>">
+ <form method="get" action="<?php echo PHP_SELF;?>">
   <input type="hidden" name="action" value="reject" />
   <input type="hidden" name="id" value="<?php echo $id?>" />
 <?php if ($in['approved']) {?>
@@ -199,7 +201,7 @@
 <?php }?>
  </form>
 <?php if (!$in['approved']) {?>
- <form method="get" action="<?php echo $PHP_SELF;?>">
+ <form method="get" action="<?php echo PHP_SELF;?>">
   <input type="hidden" name="action" value="approve" />
   <input type="hidden" name="id" value="<?php echo $id?>" />
   <td><input type="submit" value="Approve" />
@@ -215,11 +217,11 @@
 <table width="100%">
  <tr>
   <td>
-   <a href="<?php echo "$PHP_SELF";?>">see upcoming events</a>
-   | <a href="<?php echo "$PHP_SELF?unapproved=1";?>">see unapproved events</a>
+   <a href="<?php echo PHP_SELF?>">see upcoming events</a>
+   | <a href="<?php echo PHP_SELF . "?unapproved=1"?>">see unapproved events</a>
   </td>
   <td align="right">
-   <form method="GET" action="<?php echo $PHP_SELF;?>">
+   <form method="GET" action="<?php echo PHP_SELF;?>">
     <input type="text" name="search" value="<?php echo clean($search);?>" />
     <input type="submit" value="search">
    </form>
@@ -266,19 +268,19 @@
 ?>
 <table border="0" cellspacing="1" width="100%">
 <tr bgcolor="#aaaaaa">
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("full" => $full ? 0 : 1));?>"><?php echo $full ? "&otimes;" : "&oplus;";?></a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"sdato"));?>">date</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"sdesc"));?>">summary</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"email"));?>">email</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"country"));?>">country</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"category"));?>">category</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("full" => $full ? 0 : 1));?>"><?php echo $full ? "&otimes;" : "&oplus;";?></a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"sdato"));?>">date</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"sdesc"));?>">summary</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"email"));?>">email</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"country"));?>">country</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"category"));?>">category</a></th>
 </tr>
 <?php
 $color = '#dddddd';
 while ($row = mysql_fetch_array($res,MYSQL_ASSOC)) {
 ?>
 <tr bgcolor="<?php echo $color;?>">
- <td align="center"><a href="<?php echo "$PHP_SELF?id=$row[id]";?>">edit</a></td>
+ <td align="center"><a href="<?php echo PHP_SELF . "?id=$row[id]";?>">edit</a></td>
  <td><?php echo htmlspecialchars($row['sdato']);?></td>
  <td><?php echo htmlspecialchars($row['sdesc']);?></td>
  <td><?php echo htmlspecialchars($row['email']);?></td>

Modified: web/php-master/trunk/manage/mirrors.php
===================================================================
--- web/php-master/trunk/manage/mirrors.php	2011-06-01 19:33:04 UTC (rev 311719)
+++ web/php-master/trunk/manage/mirrors.php	2011-06-02 00:05:23 UTC (rev 311720)
@@ -2,6 +2,8 @@
 // Force login and include common functions
 include '../include/login.inc';

+define('PHP_SELF', htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'));
+
 // This page is for mirror administration
 head("mirror administration");
 db_connect();
@@ -123,7 +125,7 @@

   // Print out mirror data table with or without values
 ?>
-<form method="POST" action="<?php echo $PHP_SELF; ?>">
+<form method="POST" action="<?php echo PHP_SELF; ?>">
  <input type="hidden" name="id" value="<?php echo $row['id']; ?>" />
  <input type="hidden" name="mode" value="<?php echo $id ? 'update' : 'insert'; ?>" />

@@ -227,7 +229,7 @@
 <hr />

 <?php if ($row['mirrortype'] == 1 && $id !== 0) {  // only allow standard mirror deletions ?>
-<form method="POST" action="<?php echo $PHP_SELF; ?>">
+<form method="POST" action="<?php echo PHP_SELF; ?>">
  <input type="hidden" name="id" value="<?php echo $row['id']; ?>" />
  <input type="hidden" name="hostname" value="<?php echo $row['hostname']; ?>" />
  Delete mirror for this reason:<br />

Modified: web/php-master/trunk/manage/users.php
===================================================================
--- web/php-master/trunk/manage/users.php	2011-06-01 19:33:04 UTC (rev 311719)
+++ web/php-master/trunk/manage/users.php	2011-06-02 00:05:23 UTC (rev 311720)
@@ -7,6 +7,8 @@
 require '../include/login.inc';
 require '../include/email-validation.inc';

+define('PHP_SELF', htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'));
+
 $mailto = "group@php.net";

 head("user administration");
@@ -203,7 +205,7 @@
 }
 </style>
 <table class="useredit">
-<form method="post" action="<?php echo $PHP_SELF;?>">
+<form method="post" action="<?php echo PHP_SELF;?>">
 <input type="hidden" name="id" value="<?php echo $row[userid];?>" />
 <tr>
  <th align="right">Name:</th>
@@ -288,13 +290,13 @@
 </form>
 <?php if (is_admin($user) && !$row[cvsaccess]) {?>
 <tr>
- <form method="get" action="<?php echo $PHP_SELF;?>">
+ <form method="get" action="<?php echo PHP_SELF;?>">
   <input type="hidden" name="action" value="remove" />
   <input type="hidden" name="noclose" value="1" />
   <input type="hidden" name="id" value="<?php echo $id?>" />
   <td><input type="submit" value="Reject" />
  </form>
- <form method="get" action="<?php echo $PHP_SELF;?>">
+ <form method="get" action="<?php echo PHP_SELF;?>">
   <input type="hidden" name="action" value="approve" />
   <input type="hidden" name="noclose" value="1" />
   <input type="hidden" name="id" value="<?php echo $id?>" />
@@ -317,15 +319,15 @@
 ?>
 <div>
 <div style="float:right">
-   <form method="GET" action="<?php echo $PHP_SELF;?>">
+   <form method="GET" action="<?php echo PHP_SELF;?>">
     <input type="text" name="search" value="<?php echo clean($search);?>" />
     <input type="submit" value="search"><br>
     <input type="checkbox" name="searchnotes" value="1" <?php echo isset($_GET['searchnotes']) ? 'checked="checked"' : ''?>> Search notes
    </form>
 </div>
 <div>
-    <a href="<?php echo "$PHP_SELF?username=$user";?>">edit your entry</a>
-  | <a href="<?php echo "$PHP_SELF?unapproved=1";?>">see outstanding requests</a>
+    <a href="<?php echo PHP_SELF . "?username=$user";?>">edit your entry</a>
+  | <a href="<?php echo PHP_SELF . "?unapproved=1";?>">see outstanding requests</a>
 </div>
 </div>
 <?php
@@ -386,20 +388,20 @@
 ?>
 <table border="0" cellspacing="1" width="100%">
 <tr bgcolor="#aaaaaa">
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("full" => $full ? 0 : 1));?>"><?php echo $full ? "&otimes;" : "&oplus;";?></a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"name"));?>">name</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"email"));?>">email</a></th>
- <th><a href="<?php echo "$PHP_SELF?",array_to_url($extra,array("order"=>"username"));?>">username</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("full" => $full ? 0 : 1));?>"><?php echo $full ? "&otimes;" : "&oplus;";?></a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"name"));?>">name</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"email"));?>">email</a></th>
+ <th><a href="<?php echo PHP_SELF,'?',array_to_url($extra,array("order"=>"username"));?>">username</a></th>
 </tr>
 <?php
 $color = '#dddddd';
 while ($row = mysql_fetch_array($res)) {
 ?>
 <tr bgcolor="<?php echo $color;?>">
- <td align="center"><a href="<?php echo "$PHP_SELF?id=$row[userid]";?>">edit</a></td>
+ <td align="center"><a href="<?php echo PHP_SELF . "?id=$row[userid]";?>">edit</a></td>
  <td><?php echo htmlspecialchars($row[name]);?></td>
  <td><?php echo htmlspecialchars($row[email]);?></td>
- <td<?php if ($row[username] && !$row[cvsaccess]) echo ' bgcolor="#ff',substr($color,2),'"';?>><?php echo htmlspecialchars($row[username]);?><?php if ($row[username] && is_admin($user)) { if (!$row[cvsaccess]) echo " <a href=\"$PHP_SELF?action=approve&amp;noclose=1&amp;id=$row[userid]\" title=\"approve\">+</a>"; echo " <a href=\"$PHP_SELF?action=remove&amp;noclose=1&amp;id=$row[userid]\" title=\"remove\">&times;</a>"; }?></td>
+ <td<?php if ($row[username] && !$row[cvsaccess]) echo ' bgcolor="#ff',substr($color,2),'"';?>><?php echo htmlspecialchars($row[username]);?><?php if ($row[username] && is_admin($user)) { if (!$row[cvsaccess]) echo ' <a href="'. PHP_SELF . "?action=approve&amp;noclose=1&amp;id=$row[userid]\" title=\"approve\">+</a>"; echo ' <a href="'.PHP_SELF."?action=remove&amp;noclose=1&amp;id=$row[userid]\" title=\"remove\">&times;</a>"; }?></td>
 </tr>
 <?php
   if ($full && $row[note]) {?>
@@ -413,7 +415,7 @@
 ?>
 </table>
 <?php show_prev_next($begin,mysql_num_rows($res),$max,$total,$extra); ?>
-<p><a href="<?php echo $PHP_SELF;?>?id=0">add a new user</a></p>
+<p><a href="<?php echo PHP_SELF;?>?id=0">add a new user</a></p>
 <?php
 foot();