From d25c3ca1e648fe7c6071b2dd02a8f170441b7dc0 Mon Sep 17 00:00:00 2001
From: real_nowhereman <real_nowhereman@aa359531-4221-0410-9edc-b0b45c38dadb>
Date: Thu, 28 Jan 2010 09:38:10 +0000
Subject: [PATCH] fixed XSS http://www.securityfocus.com/bid/37471/info

---
 fp-interface/sharedtpls/contact.tpl | 2 +-
 fp-interface/sharedtpls/login.tpl   | 2 +-
 fp-interface/sharedtpls/search.tpl  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fp-interface/sharedtpls/contact.tpl b/fp-interface/sharedtpls/contact.tpl
index e5ef80c..febed51 100755
--- a/fp-interface/sharedtpls/contact.tpl
+++ b/fp-interface/sharedtpls/contact.tpl
@@ -6,7 +6,7 @@
 {validate id="content" message=$lang.contact.error.content append="error"}
 
 <form id="contactform" method="post"
-	action="{$smarty.server.PHP_SELF}"
+	action="{$smarty.const.BLOG_BASEURL}contact.php"
 	enctype="multipart/form-data">
 	
 	{include file='shared:errorlist.tpl'}
diff --git a/fp-interface/sharedtpls/login.tpl b/fp-interface/sharedtpls/login.tpl
index fd0861e..d8fa4f1 100755
--- a/fp-interface/sharedtpls/login.tpl
+++ b/fp-interface/sharedtpls/login.tpl
@@ -1,6 +1,6 @@
 {include file=shared:errorlist.tpl}
 
-<form id="login" method="post" action="{$smarty.server.PHP_SELF}" enctype="multipart/form-data">
+<form id="login" method="post" action="{$smarty.const.BLOG_BASEURL}login.php" enctype="multipart/form-data">
 	<fieldset><legend>{$lang.login.fieldset1}</legend>
 	<p><label for="user">{$lang.login.user}</label><br />
 	<input {$error.user|notempty:'class="field-error"'} type="text" name="user" id="user" {if $smarty.post.user}value="{$smarty.post.user|wp_specialchars:true}"{/if} /></p>
diff --git a/fp-interface/sharedtpls/search.tpl b/fp-interface/sharedtpls/search.tpl
index 747f02f..d6b6342 100755
--- a/fp-interface/sharedtpls/search.tpl
+++ b/fp-interface/sharedtpls/search.tpl
@@ -1,5 +1,5 @@
 {include file=shared:errorlist.tpl}
-<form id="search" method="get" action="{$smarty.server.PHP_SELF}" enctype="multipart/form-data">
+<form id="search" method="get" action="{$smarty.const.BLOG_BASEURL}search.php" enctype="multipart/form-data">
 		
 	<fieldset><legend>{$lang.search.fset1}</legend>
 	<p><label for="keywords">{$lang.search.keywords}</label><br />