From dc272e4432d42e2c9388de857849aeffcafc2c98 Mon Sep 17 00:00:00 2001
From: Marco Antonio Nina <marcoantonionina@colosa.com>
Date: Wed, 1 Aug 2012 18:37:43 -0400
Subject: [PATCH] BUG 9525 ProcessMaker 404 not found page is vulnerable to
 exploits SOLVED

- It is printed directly a variable GET.
- Used htmlentities().
---
 gulliver/methods/errors/error404.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/gulliver/methods/errors/error404.php b/gulliver/methods/errors/error404.php
index d9cb36807..e31725e03 100755
--- a/gulliver/methods/errors/error404.php
+++ b/gulliver/methods/errors/error404.php
@@ -22,7 +22,10 @@
  * Coral Gables, FL, 33134, USA, or email info@colosa.com.
  * 
  */
-session_start();
+$session = session_id();
+if (empty($session)) {
+    session_start();
+}
 
 if ( isset ( $_SESSION['phpFileNotFound'] ) ) {
     $uri = $_SESSION['phpFileNotFound'];
@@ -31,7 +34,8 @@ if ( isset ( $_SESSION['phpFileNotFound'] ) ) {
 } else {
     $uri = 'undefined';
 }
-$referer =  isset ( $_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : $_SESSION['phpLastFileFound'];
+$referer =  isset ( $_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] :
+    (isset($_SESSION['phpLastFileFound']) ? $_SESSION['phpLastFileFound'] : '');
 
 $ERROR_TEXT = "404 Not Found ";
 $ERROR_DESCRIPTION = "