RE: phpweb / submit-event.php

this is not safe, on previewing the event it executes the code, therefore conforming to the cross site scripting vulnerability. -- james > -----Original Message----- > From: jim winstead [mailto:jimw@apache.org] > Sent: Thursday, May 02, 2002 7:04 PM > To: php-mirrors@lists.php.net > Subject: cvs: phpweb / submit-event.php > > > jimw Thu May 2 14:03:45 2002 EDT > > Modified files: > /phpweb submit-event.php > Log: > this was already safe. these checks are completely bogus. > > Index: phpweb/submit-event.php > diff -u phpweb/submit-event.php:1.8 phpweb/submit-event.php:1.9 > --- phpweb/submit-event.php:1.8 Thu May 2 13:56:23 2002 > +++ phpweb/submit-event.php Thu May 2 14:03:44 2002 > @@ -17,13 +17,6 @@ > > # clean and validate data > > -if (!is_numeric($id) || !is_numeric($cy) || !is_numeric($cd) || > !is_numeric($cm)) { > - $errors[] = "invalid data specified"; > - $hack = 1; > -} > - > -if (!$hack) { > - > if (!is_emailable_address($in['email'])) { > $errors[] = 'You must supply a valid email address.'; > } > @@ -93,7 +86,7 @@ > exit; > } > } > -} > + > if (!$errors) {?> > <p>The following is a preview of your event submission. Please > double-check it > to make sure all of the information is correct.</p> > @@ -107,11 +100,7 @@ > <?php > } > > -if ($errors) { > - display_errors($errors); > - commonFooter(); > - exit(); > -} > +if ($errors) display_errors($errors); > > for ($i = 1; $i <= 7; $i++) { > $days[$i] = strftime('%A',mktime(12,0,0,4,$i,2001)); > >