diff --git a/admin/cms.php b/admin/cms.php index 5a957adb..ecd787f9 100644 --- a/admin/cms.php +++ b/admin/cms.php @@ -36,11 +36,11 @@ "website_content_management" ); - if($_POST['action']=="save") + if(get_value_from_array($_POST, 'action',"save")) { $err=false; foreach($config['languages'] AS $lang=>$langname) { - $filename=stripslashes($_POST['filename']); + $filename=stripslashes(get_value_from_array($_POST, 'filename', '')); // $filename=ereg_replace("[^A-Za-z0-9\.\_\/]","_",$_POST['filename']); if(substr($filename,-5)!=".html") @@ -51,7 +51,7 @@ $showlogoname="showlogo_$lang"; //get the dt here to insert with ALL the languages, we cant rely on the INSERT NOW() always inserting multiple records with the same timestamp! $insertdt=date("Y-m-d H:i:s"); - $text=stripslashes($_POST[$textname]); + $text=stripslashes(get_value_from_array($_POST,$textname, '')); $q = $pdo->prepare("INSERT INTO cms (filename,dt,lang,text,title,showlogo) VALUES ( @@ -59,8 +59,8 @@ '$insertdt', '$lang', '".$text."', - '".$_POST[$titlename]."', - '".$_POST[$showlogoname]."' + '".get_value_from_array($_POST, $titlename, '')."', + '".get_value_from_array($_POST, $showlogoname, '')."' )"); $q->execute(); if($pdo->errorInfo()) { @@ -72,7 +72,7 @@ echo happy(i18n("%1 successfully saved",array($_POST['filename']))); } - if($_GET['filename'] || $_GET['action']=="create") + if(get_value_from_array($_GET,'filename', '') || get_value_from_array($_GET,'action',"create")) { echo "<< Back to file list\n"; echo "