cvs: phpweb / submit-event.php

bjori		Thu Feb 14 08:33:39 2008 UTC

  Modified files:              
    /phpweb	submit-event.php 
  Log:
  Fixed full path disclosure reported by John McKenzie
  
  
http://cvs.php.net/viewvc.cgi/phpweb/submit-event.php?r1=1.37&r2=1.38&diff_format=u
Index: phpweb/submit-event.php
diff -u phpweb/submit-event.php:1.37 phpweb/submit-event.php:1.38
--- phpweb/submit-event.php:1.37	Sun Jun 24 20:28:53 2007
+++ phpweb/submit-event.php	Thu Feb 14 08:33:38 2008
@@ -1,5 +1,5 @@
 <?php
-// $Id: submit-event.php,v 1.37 2007/06/24 20:28:53 rasmus Exp $
+// $Id: submit-event.php,v 1.38 2008/02/14 08:33:38 bjori Exp $
 $_SERVER['BASE_PAGE'] = 'submit-event.php';
 include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc';
 include_once $_SERVER['DOCUMENT_ROOT'] . '/include/posttohost.inc';
@@ -56,14 +56,15 @@
     }
 
     $valid_schemes = array('http','https','ftp');
-    $pu = parse_url($_POST['url']);
 
     $_POST['url'] = trim($_POST['url']);
-    $pu['host'] = trim($pu['host']);
+    $pu = parse_url($_POST['url']);
+    $pu['host'] = isset($pu['host']) ? trim($pu['host']) : '';
+
     if (!$_POST['url']) {
         $errors[] = "You must supply a URL with more information about the event.";
     }
-    elseif (!in_array($pu['scheme'], $valid_schemes) || empty($pu['host'])) {
+    elseif (empty($pu['host']) || !in_array($pu['scheme'], $valid_schemes)) {
         $errors[] = "The URL you supplied was invalid.";
     }
 
@@ -109,7 +110,7 @@
         if ($result) {
             $errors[] = "There was an error processing your submission: $result";
         }
-        if (!$errors) {
+        if (count($errors) === 0) {
             echo "<p>\n Thank you for your submission! You should hear back soon\n" .
                  " as to whether your event has been accepted for inclusion in\n" .
                  " our calendar.\n</p>";
@@ -118,7 +119,7 @@
         }
     }
 
-    if (!$errors) {
+    if (count($errors) === 0) {
         echo "<p>\n The following is a preview of your event submission.\n" .
              " Please double-check it to make sure all of the information is correct.\n</p>";
     }
@@ -132,7 +133,7 @@
 }
 
 // Display errors if found
-if ($errors) { display_errors($errors); }
+if (count($errors)) { display_errors($errors); }
 
 // Generate days and months arrays for form
 for ($i = 1; $i <= 7; $i++) {
@@ -154,7 +155,7 @@
 );
 
 // If we have data, display preview
-if ($process) {
+if ($process && count($errors) === 0) {
     echo "<p><strong>Preview:</strong></p>\n";
     display_event($_POST);
     echo "<p><strong>Change:</strong></p>\n";