Changeset 185 for branches/1.1dev/bin/module_maker/module.cli.php

Timestamp:

Jun 24, 2006 11:02:54 PM (18 years ago)

Author:

scdev

Message:

Q - added oTxt() around all printed PHP_SELFs to avoid XSS attack. See: ​http://blog.phpdoc.info/archives/13-XSS-Woes.html

File:

• branches/1.1dev/bin/module_maker/module.cli.php (modified) (1 diff)

branches/1.1dev/bin/module_maker/module.cli.php

@@ -248 +248 @@
 $search['admin_form_tag_init'] = '/%ADMIN_FORM_TAG_INIT%/';
 if ($multipart_form_required) {
-    $replace['admin_form_tag_init'] = "<form enctype=\"multipart/form-data\" method=\"post\" action=\"<\x3fphp echo \$_SERVER['PHP_SELF']; \x3f>\">\n<input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"12000000\">";
-} else {
-    $replace['admin_form_tag_init'] = "<form method=\"post\" action=\"<\x3fphp echo \$_SERVER['PHP_SELF']; \x3f>\">";
+    $replace['admin_form_tag_init'] = "<form enctype=\"multipart/form-data\" method=\"post\" action=\"<\x3fphp echo oTxt(\$_SERVER['PHP_SELF']); \x3f>\">\n<input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"12000000\">";
+} else {
+    $replace['admin_form_tag_init'] = "<form method=\"post\" action=\"<\x3fphp echo oTxt(\$_SERVER['PHP_SELF']); \x3f>\">";
 }