Re: XXS in script Phorum

[brian@xxxxxxxxxx]

Once again, a false report about Phorum.  Please issue an apology ASAP.

1. upgradefiles as a var is only used inside a function.  PHP does not take 
variables from the global scope for use in functions automatically.

2. 2 lines before that var is echoed, it is set by reading a file name from 
disk using the dir() function in PHP.

3. The dir() function reads from a hard coded, relative path on disk and does 
not use a variable.

Thanks for trying.  If you find a real bug, please let us know.  We strive to 
make Phorum as bug free as possible.