Re: XXS in script Phorum
Once again, a false report about Phorum. Please issue an apology ASAP.
1. upgradefiles as a var is only used inside a function. PHP does not take variables from the global scope for use in functions automatically.
2. 2 lines before that var is echoed, it is set by reading a file name from disk using the dir() function in PHP.
3. The dir() function reads from a hard coded, relative path on disk and does not use a variable.
Thanks for trying. If you find a real bug, please let us know. We strive to make Phorum as bug free as possible.
討論串 (同標題文章)