cvs: peardoc /en/package/authentication/auth-prefmanager tutorial.xml /en/package/html/html-form examples.xml intro.xml /en/package/html/pager
getperpageselectbox.xml

danielc Mon Jun 13 13:05:18 2005 EDT Modified files: /peardoc/en/package/authentication/auth-prefmanager tutorial.xml /peardoc/en/package/html/html-form examples.xml intro.xml /peardoc/en/package/html/pager getperpageselectbox.xml Log: * PHP_SELF can be tainted. Change examples to promote good security pracitices. http://cvs.php.net/diff.php/peardoc/en/package/authentication/auth-prefmanager/tutorial.xml?r1=1.3&r2=1.4&ty=u Index: peardoc/en/package/authentication/auth-prefmanager/tutorial.xml diff -u peardoc/en/package/authentication/auth-prefmanager/tutorial.xml:1.3 peardoc/en/package/authentication/auth-prefmanager/tutorial.xml:1.4 --- peardoc/en/package/authentication/auth-prefmanager/tutorial.xml:1.3 Thu Jun 17 03:18:40 2004 +++ peardoc/en/package/authentication/auth-prefmanager/tutorial.xml Mon Jun 13 13:05:17 2005 @@ -1,4 +1,4 @@ -<!-- $Revision: 1.3 $ --> +<!-- $Revision: 1.4 $ --> <refentry id="package.authentication.auth-prefmanager.tutorial"> <refnamediv> <refname> @@ -118,7 +118,7 @@ ?> <h1>Welcome to the people of <?=$prefmanager->getPref($username, "country")?>!</h1> <h2>Set Country And Username</h2> -<form method="post" action="<?=$_SERVER['PHP_SELF']?>"> +<form method="post" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']) ?>"> <label for="username">Username</label> <input name="username" value="<?=$username?>" /><br/> <label for="country">Country</label> <input name="country" value="<?=$prefmanager->getPref($username, 'country')?>"/><br/> <input type="submit" name="submit" value="Set Country" /> <input type="submit" name="reset" value="Reset Country" /> http://cvs.php.net/diff.php/peardoc/en/package/html/html-form/examples.xml?r1=1.3&r2=1.4&ty=u Index: peardoc/en/package/html/html-form/examples.xml diff -u peardoc/en/package/html/html-form/examples.xml:1.3 peardoc/en/package/html/html-form/examples.xml:1.4 --- peardoc/en/package/html/html-form/examples.xml:1.3 Tue May 18 16:21:03 2004 +++ peardoc/en/package/html/html-form/examples.xml Mon Jun 13 13:05:18 2005 @@ -1,4 +1,4 @@ -<!-- $Revision: 1.3 $ --> +<!-- $Revision: 1.4 $ --> <refentry id="package.html.html-form.examples"> <refentryinfo> <author> @@ -30,7 +30,7 @@ <![CDATA[ require_once "HTML/Form.php"; -$form = new HTML_Form($_SERVER['PHP_SELF']); +$form = new HTML_Form('receivingscript.php'); $form->addText("name", "What's your name?"); $form->addText("email", "What's your email address?"); http://cvs.php.net/diff.php/peardoc/en/package/html/html-form/intro.xml?r1=1.5&r2=1.6&ty=u Index: peardoc/en/package/html/html-form/intro.xml diff -u peardoc/en/package/html/html-form/intro.xml:1.5 peardoc/en/package/html/html-form/intro.xml:1.6 --- peardoc/en/package/html/html-form/intro.xml:1.5 Tue May 18 16:21:03 2004 +++ peardoc/en/package/html/html-form/intro.xml Mon Jun 13 13:05:18 2005 @@ -1,4 +1,4 @@ -<!-- $Revision: 1.5 $ --> +<!-- $Revision: 1.6 $ --> <refentry id="package.html.html-form.intro"> <refentryinfo> <author> @@ -52,7 +52,7 @@ <![CDATA[ require_once "HTML/Form.php"; -$form = new HTML_Form($_SERVER['PHP_SELF']); +$form = new HTML_Form('receivingscript.php'); $form->addText("name", "What's your name?"); $form->addSubmit("submit", "Go, Go"); http://cvs.php.net/diff.php/peardoc/en/package/html/pager/getperpageselectbox.xml?r1=1.5&r2=1.6&ty=u Index: peardoc/en/package/html/pager/getperpageselectbox.xml diff -u peardoc/en/package/html/pager/getperpageselectbox.xml:1.5 peardoc/en/package/html/pager/getperpageselectbox.xml:1.6 --- peardoc/en/package/html/pager/getperpageselectbox.xml:1.5 Mon Jun 13 12:50:00 2005 +++ peardoc/en/package/html/pager/getperpageselectbox.xml Mon Jun 13 13:05:18 2005 @@ -1,4 +1,4 @@ -<!-- $Revision: 1.5 $ --> +<!-- $Revision: 1.6 $ --> <refentry id="package.html.pager.getperpageselectbox"> <refnamediv> @@ -92,7 +92,7 @@ $selectBox = $pager->getPerPageSelectBox(); -echo '<form action="'.$_SERVER['PHP_SELF'].'" method="GET">'; +echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="GET">'; echo $selectBox; echo '<input type="submit" value="submit" />'; echo '</form>';