cvs: phpweb / submit-event.php
| From: | Rasmus Lerdorf | Date: | Sun, 11 Feb 2007 06:55:53 +0000 |
| Subject: | cvs: phpweb / submit-event.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-34218@lists.php.net to get a copy of this message | ||
rasmus Sun Feb 11 06:55:53 2007 UTC
Modified files:
/phpweb submit-event.php
Log:
Better URL check here
http://cvs.php.net/viewvc.cgi/phpweb/submit-event.php?r1=1.31&r2=1.32&diff_format=u
Index: phpweb/submit-event.php
diff -u phpweb/submit-event.php:1.31 phpweb/submit-event.php:1.32
--- phpweb/submit-event.php:1.31 Sat Jan 6 17:05:07 2007
+++ phpweb/submit-event.php Sun Feb 11 06:55:53 2007
@@ -1,5 +1,5 @@
<?php
-// $Id: submit-event.php,v 1.31 2007/01/06 17:05:07 bjori Exp $
+// $Id: submit-event.php,v 1.32 2007/02/11 06:55:53 rasmus Exp $
$_SERVER['BASE_PAGE'] = 'submit-event.php';
include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc';
include_once $_SERVER['DOCUMENT_ROOT'] . '/include/posttohost.inc';
@@ -55,12 +55,15 @@
$errors[] = "You must supply a long description of the event.";
}
+ $valid_schemes = array('http','https','ftp');
+ $pu = parse_url($_POST['url']);
+
$_POST['url'] = trim($_POST['url']);
if (!$_POST['url']) {
$errors[] = "You must supply a URL with more information about the event.";
}
- elseif (!preg_match('/^\w+:/', $_POST['url'])) {
- $errors[] = "The URL you supplied was incomplete.";
+ elseif (!in_array($pu['scheme'], $schemes) || empty(trim($pu['host']))) {
+ $errors[] = "The URL you supplied was invalid.";
}
if (!$_POST['country']) {