! -> Note
$ -> Affected files
+03-Nov-2010 Janusz Dobrowolski
+# More corrections in cleanup for input
+$ /includes/session.inc
+
02-Nov-2010 Joe Hunt
# Report Customer Details didn't show up correctly in Excel
$ /reporting/rep103.php
if (!isset($_SESSION["wa_current_user"]))
$_SESSION["wa_current_user"] = new current_user();
+html_cleanup($_GET);
+html_cleanup($_POST);
+html_cleanup($_REQUEST);
+
// logout.php is the only page we should have always
// accessable regardless of access level and current login status.
if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
{
// strip ajax marker from uri, to force synchronous page reload
$_SESSION['timeout'] = array( 'uri'=>preg_replace('/JsHttpRequest=(?:(\d+)-)?([^&]+)/s',
- '', @$_SERVER['REQUEST_URI']),
+ '', @htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, $_SESSION['language']->encoding)),
'post' => $_POST);
include($path_to_root . "/access/login.php");
// We quote all values later with db_escape() before db update.
$_POST = strip_quotes($_POST);
-html_cleanup($_GET);
-html_cleanup($_POST);
?>
\ No newline at end of file