svn: /web/php-master/trunk/ forgot.php

felipe Thu, 24 Mar 2011 22:35:12 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=309672 Log: - Fixed bug #54376 (XSS vulnerability in master...) Bug: http://bugs.php.net/54376 (error getting bug information) Changed paths: U web/php-master/trunk/forgot.php Modified: web/php-master/trunk/forgot.php =================================================================== --- web/php-master/trunk/forgot.php 2011-03-24 22:09:16 UTC (rev 309671) +++ web/php-master/trunk/forgot.php 2011-03-24 22:35:12 UTC (rev 309672) @@ -50,7 +50,7 @@ <p>You're in the home stretch now. Just choose a new password (typing it twice, to avoid typos and another trip around this merry-go-round).</p> -<form method="post" action="<?php echo $PHP_SELF?>"> +<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']) ?>"> password: <input type="password" name="n1" value="<?php echo htmlentities(stripslashes($n1))?>" /> <br />again: <input type="password" name="n2" value="<?php echo htmlentities(stripslashes($n1))?>" /> <br /><input type="submit" value="do it!" /> @@ -103,7 +103,7 @@ ?> <p>Forgot your <acronym title="Version Control System">VCS</acronym> password, huh? Just fill in your VCS username, and instructions will be sent to you on how to change your password.</p> -<form method="post" action="<?php echo $PHP_SELF?>"> +<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']) ?>"> <label for="user">username:</label> <input type="text" id="user" name="user" value="<?php echo htmlentities(stripslashes($user))?>" /> <input type="submit" value="send help" />