--- CWIS-1.4.2-orig/SPT--ImportUsersExecute.php 2007-05-29 13:38:10.000000000 -0400 +++ CWIS-1.4.2/SPT--ImportUsersExecute.php 2008-03-12 15:51:29.000000000 -0400 @@ -241,11 +241,11 @@ # register some key variables for other html code $Session->PassVariable("ImportComplete", $ImportComplete); -if (isset($_POST['F_FileName']['tmp_name']) && - is_uploaded_file($_POST['F_FileName']['tmp_name'])) +if (isset($_FILES['F_FileName']['tmp_name']) && + is_uploaded_file($_FILES['F_FileName']['tmp_name'])) { # zero length or tiny file - if ($_POST['F_FileName']['size'] == 0) + if ($_FILES['F_FileName']['size'] == 0) { $ErrorMessage = "Error: File doesn't exist or is empty."; $Session->PassVariable("ErrorMessage", $ErrorMessage); @@ -257,12 +257,12 @@ $TempFile = dirname($ScriptFileName). "/TempStorage/". - $_POST['F_FileName']['name']; + $_FILES['F_FileName']['name']; - copy($_POST['F_FileName']['tmp_name'], $TempFile); + copy($_FILES['F_FileName']['tmp_name'], $TempFile); $fp = fopen($TempFile, 'r'); - unlink($_POST['F_FileName']['tmp_name']); + unlink($_FILES['F_FileName']['tmp_name']); } else if ($FSeek > 0) { @@ -270,7 +270,7 @@ } else { - switch($_POST['F_FileName']['error']) + switch($_FILES['F_FileName']['error']) { # no error; possible file attack! case 0: