Security patch

Form.class.php

<?php

class IPC_Form extends sfForm {

    /**
     * Binds the form with input values.
     *
     * It triggers the validator schema validation.
     *
     * @param array $taintedValues  An array of input values
     * @param array $taintedFiles   An array of uploaded files (in the $_FILES or $_GET format)
     */
    public function bind(array $taintedValues = null, array $taintedFiles = null)
    {
        $this->taintedValues = $taintedValues;
        $this->taintedFiles = $taintedFiles;
        $this->isBound = true;
        $this->resetFormFields();

        if (null === $this->taintedValues) {
            $this->taintedValues = array();
        }

        if (null === $this->taintedFiles) {
            if ($this->isMultipart()) {
                throw new InvalidArgumentException('This form is multipart, which means you need to supply a files array as the bind() method second argument.');
            }

            $this->taintedFiles = array();
        }

        $this->checkTaintedValues($this->taintedValues);

        try {
            $this->doBind(self::deepArrayUnion($this->taintedValues, self::convertFileInformation($this->taintedFiles)));
            $this->errorSchema = new sfValidatorErrorSchema($this->validatorSchema);

            // remove CSRF token
            unset($this->values[self::$CSRFFieldName]);
        } catch (sfValidatorErrorSchema $e) {
            $this->values = array();
            $this->errorSchema = $e;
        }
    }

    /**
     * Checks that the $_POST values do not contain something that
     * looks like a file upload (coming from $_FILE).
     */
    protected function checkTaintedValues($values)
    {
        foreach ($values as $name => $value) {
            if (!is_array($value)) {
                continue;
            }

            if (isset($value['tmp_name'])) {
                throw new InvalidArgumentException('Do not try to fake a file upload.');
            }

            $this->checkTaintedValues($value);
        }
    }

}