Hi all,<div><br></div><div>While looking into a bug, I came across this piece of code in display_export.lib.php. </div><div><br></div><div><div>// If the form data is being loaded from GET data, decode it</div><div>foreach($_GET as $name =&gt; $value) {</div>
<div>    if(is_string($value)) {</div><div>        $_GET[urldecode($name)] = urldecode($value);</div><div>    }</div><div>}</div><div><br></div><div>Due to this $_GET is urldecoded twice and + signs in the sql query (which is passed inside $_GET) are replaced with spaces making it malformed.</div>
<div>Any clue why this piece of code got in here? Or am I not seeing anything?</div><br>-- <br>Thanks and Regards,<div><br></div><div>Madhura Jayaratne<br><div><br></div></div><br>
</div>