diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 9690da8c1..dd3a0693a 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -4,7 +4,7 @@ /** * Misc stuff and functions used by almost all the scripts. - * Among other things, it contains the advanced authentification work. + * Among other things, it contains the advanced authentication work. */ /** @@ -2484,6 +2484,43 @@ window.parent.updateTableTitle( '', ' $value ) { + if ( ! in_array( $key, $variables_whitelist ) ) { + unset( $$key ); + } +} +unset( $key, $value ); + + +/** + * protect against older PHP versions' bug about GLOBALS overwrite + * (no need to localize this message :) ) + * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ??? + */ +if ( isset( $_REQUEST['GLOBALS'] ) || isset( $_FILES['GLOBALS'] ) + || isset( $_SERVER['GLOBALS'] ) || isset( $_COOKIE['GLOBALS'] ) + || isset( $_ENV['GLOBALS'] ) ) { + die( 'GLOBALS overwrite attempt' ); +} + +require_once './libraries/session.inc.php'; + // grab_globals.lib.php should really go before common.lib.php require_once('./libraries/grab_globals.lib.php'); diff --git a/libraries/grab_globals.lib.php b/libraries/grab_globals.lib.php index 7443d1646..dad3d29dd 100644 --- a/libraries/grab_globals.lib.php +++ b/libraries/grab_globals.lib.php @@ -12,45 +12,6 @@ * loic1 - 2001/25/11: use the new globals arrays defined with php 4.1+ */ -/** - * just to be sure there was no import (registering) before here - * we empty the global space - */ -$variables_whitelist = array ( - 'GLOBALS', - '_SERVER', - '_GET', - '_POST', - '_REQUEST', - '_FILES', - '_ENV', - '_COOKIE', - '_SESSION', -); - -foreach ( get_defined_vars() as $key => $value ) { - if ( ! in_array( $key, $variables_whitelist ) ) { - unset( $$key ); - } -} -unset( $key, $value ); - - -/** - * protect against older PHP versions' bug about GLOBALS overwrite - * (no need to translate this one :) ) - * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ??? - */ -if ( isset( $_REQUEST['GLOBALS'] ) || isset( $_FILES['GLOBALS'] ) - || isset( $_SERVER['GLOBALS'] ) || isset( $_COOKIE['GLOBALS'] ) - || isset( $_ENV['GLOBALS'] ) ) { - die( 'GLOBALS overwrite attempt' ); -} - - -require_once './libraries/session.inc.php'; - - /** * check if a subform is submitted */