Bug #658

basename on action is counterproductive

Details

Submitted	2004-02-01 04:26 UTC
From	joey at q7 dot com
Assigned	danielc
Status	Closed
Package	HTML_Form
PHP Version	Irrelevant
OS	Linux
Roadmaps	(Not assigned)

Comments

[2004-02-01 04:26 UTC] joey at q7 dot com

Description:
------------
the action passed to the new() function gets basename()ed when displayed which is irritating and not really very helpful. if i want to make a form that points outside my current directory i can't do it. i haven't experimented with % encoding yet to try and get around it.

Reproduce code:
---------------
$form = new HTML_Form('http://example.com/doit.cgi');
print $form->returnStart();

Expected result:
----------------
<FORM ACTION="http://example.com/doit.cgi" METHOD="GET">

Actual result:
--------------
<FORM ACTION="doit.cgi" METHOD="GET">

[2004-02-01 04:32 UTC] joey at q7 dot com

using %2f doesn't help. hand coding the <form> tag will obviously work, but it seems like it would be worth fixing the main code. given the lack of docs for this package i hope that noone relies on that basename call :-).

[2004-03-12 04:34 UTC] joey at q7 dot com

even if there is a possible security problem, this is not data that comes from the user, so i can't see why the code would enforce a basename on it. i am of the camp that trusts the programmer. distrusting the user is ok, but that doesn't seem to apply to this case.