Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

The default form action (request_uri) didn't escape HTML entities (such as &)

4.0.x
Steven Wittens 2002-05-21 16:00:39 +00:00
parent f1f458ddf0
commit 7cd6e0b17d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
includes/common.inc
View File

@ -567,7 +567,7 @@ function format_tag($link, $text) {
} }
function form($form, $method = "post", $action = 0, $options = 0) { function form($form, $method = "post", $action = 0, $options = 0) {
return "<form action=\"". ($action ? $action : request_uri()) ."\" method=\"$method\"". ($options ? " $options" : "") .">\n$form</form>\n"; return "<form action=\"". ($action ? $action : htmlentities(request_uri())) ."\" method=\"$method\"". ($options ? " $options" : "") .">\n$form</form>\n";
} }
function form_item($title, $value, $description = 0) { function form_item($title, $value, $description = 0) {