cvs: phpweb / submit-event.php
| From: | Hannes Magnusson | Date: | Thu, 14 Feb 2008 08:33:39 +0000 |
| Subject: | cvs: phpweb / submit-event.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-1075@lists.php.net to get a copy of this message | ||
bjori Thu Feb 14 08:33:39 2008 UTC
Modified files:
/phpweb submit-event.php
Log:
Fixed full path disclosure reported by John McKenzie
http://cvs.php.net/viewvc.cgi/phpweb/submit-event.php?r1=1.37&r2=1.38&diff_format=u
Index: phpweb/submit-event.php
diff -u phpweb/submit-event.php:1.37 phpweb/submit-event.php:1.38
--- phpweb/submit-event.php:1.37 Sun Jun 24 20:28:53 2007
+++ phpweb/submit-event.php Thu Feb 14 08:33:38 2008
@@ -1,5 +1,5 @@
<?php
-// $Id: submit-event.php,v 1.37 2007/06/24 20:28:53 rasmus Exp $
+// $Id: submit-event.php,v 1.38 2008/02/14 08:33:38 bjori Exp $
$_SERVER['BASE_PAGE'] = 'submit-event.php';
include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc';
include_once $_SERVER['DOCUMENT_ROOT'] . '/include/posttohost.inc';
@@ -56,14 +56,15 @@
}
$valid_schemes = array('http','https','ftp');
- $pu = parse_url($_POST['url']);
$_POST['url'] = trim($_POST['url']);
- $pu['host'] = trim($pu['host']);
+ $pu = parse_url($_POST['url']);
+ $pu['host'] = isset($pu['host']) ? trim($pu['host']) :
'';
+
if (!$_POST['url']) {
$errors[] = "You must supply a URL with more information about the event.";
}
- elseif (!in_array($pu['scheme'], $valid_schemes) || empty($pu['host'])) {
+ elseif (empty($pu['host']) || !in_array($pu['scheme'], $valid_schemes)) {
$errors[] = "The URL you supplied was invalid.";
}
@@ -109,7 +110,7 @@
if ($result) {
$errors[] = "There was an error processing your submission: $result";
}
- if (!$errors) {
+ if (count($errors) === 0) {
echo "<p>\n Thank you for your submission! You should hear back soon\n"
.
" as to whether your event has been accepted for inclusion in\n" .
" our calendar.\n</p>";
@@ -118,7 +119,7 @@
}
}
- if (!$errors) {
+ if (count($errors) === 0) {
echo "<p>\n The following is a preview of your event submission.\n" .
" Please double-check it to make sure all of the information is
correct.\n</p>";
}
@@ -132,7 +133,7 @@
}
// Display errors if found
-if ($errors) { display_errors($errors); }
+if (count($errors)) { display_errors($errors); }
// Generate days and months arrays for form
for ($i = 1; $i <= 7; $i++) {
@@ -154,7 +155,7 @@
);
// If we have data, display preview
-if ($process) {
+if ($process && count($errors) === 0) {
echo "<p><strong>Preview:</strong></p>\n";
display_event($_POST);
echo "<p><strong>Change:</strong></p>\n";