Hi,
in the bookmarks creation dialog, we have a hidden goto that contains
"sql.php?db=mybase&table=mytable" and some other parameters.
Current logic in common.lib.php:
if (isset($_REQUEST['goto']) && in_array($_REQUEST['goto'],
$goto_whitelist)) {
fails in this case because the white list contains sql.php and we are
comparing with a $_REQUEST['goto'] containing sql.php plus parameters.
Same problem could happen for other parameters like $back, I'm not sure.
Is there another function like in_array() but able to compare a
substring? If not, we'll have to do something like:
if (isset($_REQUEST['goto']) &&
in_array(substr($_REQUEST['goto'],0,strpos($_REQUEST['goto'] .
'?','?')), $goto_whitelist)) {
Marc
Show replies by date