[Scuzzy]

Submitted:



Cutting and pasting link into another window and hitting "go":



"do" doesn't appear in the array in the submitted form, but "myaction" does...

Scuzzy

--------------- Added [DATE]1209461230[/DATE] at [TIME]1209461230[/TIME] ---------------

I attempted to add the CSRF protection to this form to see if that was the problem.

New code:

<?php
/*======================================================================*\
|| #################################################################### ||
|| #################################################################### ||
\*======================================================================*/

// ####################### SET PHP ENVIRONMENT ###########################
error_reporting(E_ALL & ~E_NOTICE);

// #################### DEFINE IMPORTANT CONSTANTS #######################
define('THIS_SCRIPT', 'testsubmit');
define('CSRF_PROTECTION', true);  

// ################### PRE-CACHE TEMPLATES AND DATA ######################
// get special phrase groups
$phrasegroups = array('fronthelp');

// get special data templates from the datastore
$specialtemplates = array();

// pre-cache templates used by all actions
$globaltemplates = array(
	'test_template'

);

// pre-cache templates used by specific actions
$actiontemplates = array();

// ######################### REQUIRE BACK-END ############################
require_once('./global.php');


$vbulletin->input->clean_array_gpc('r', array(
	'do' => TYPE_NOHTML,
	'myaction' => TYPE_NOHTML
));

$ot_do=$vbulletin->GPC['do'];
$ot_myaction = $vbulletin->GPC['myaction'];

echo "Do: $ot_do<br>";
echo "Request Do: " . $_REQUEST['do'] . "<br>";
echo "MyAction: $ot_myaction";

echo "<br>**** GPC Var Dump ****<br>";
var_dump($vbulletin->GPC);
echo "<br>**********************<br>";

eval('print_output("' . fetch_template('test_template') . '");');

?>

New Template:

<form action="testsubmit.php?myaction=myactionval&do=testdoval" method="post">
   <input maxlength=255 name=mytextval size=60>
   <input type="submit" class="button" name="sbutton" value="Send"/>
<input type="hidden" name="s" value="$session[sessionhash]" />
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
</form>

I logged into my forum, then ran this script.

Before submit:


After submit:



Scuzzy