Bugtraq: Re: XXS in script Phorum

[brian () phorum org]

Once again, a false report about Phorum.  Please issue an apology ASAP.

1. upgradefiles as a var is only used inside a function.  PHP does not take variables from the global scope for use in 
functions automatically.

2. 2 lines before that var is echoed, it is set by reading a file name from disk using the dir() function in PHP.

3. The dir() function reads from a hard coded, relative path on disk and does not use a variable.

Thanks for trying.  If you find a real bug, please let us know.  We strive to make Phorum as bug free as possible.