Index: typo3/sysext/install/mod/class.tx_install.php
===================================================================
--- typo3/sysext/install/mod/class.tx_install.php	(revision 6190)
+++ typo3/sysext/install/mod/class.tx_install.php	(working copy)
@@ -255,7 +255,7 @@
 			// ****************************
 		$this->INSTALL = t3lib_div::_GP('TYPO3_INSTALL');
 		$this->mode = t3lib_div::_GP('mode');
-		$this->step = t3lib_div::_GP('step');
+		$this->step = intval(t3lib_div::_GP('step'));
 		$this->redirect_url = t3lib_div::_GP('redirect_url');
 
 		if ($_GET['TYPO3_INSTALL']['type'])	{
@@ -331,7 +331,7 @@
 	 * Returns true if submitted password is ok. Else displays a form in which to enter password.
 	 *
 	 * @param	[type]		$uKey: ...
-	 * @return	bool		whether the submitted password is ok 
+	 * @return	bool		whether the submitted password is ok
 	 */
 	function checkPassword($uKey)	{
 		$p = t3lib_div::_GP('password');
@@ -386,7 +386,7 @@
 
 		$content = '<form action="index.php" method="post" name="passwordForm">
 			<input type="password" name="password"><br />
-			<input type="hidden" name="redirect_url" value="'.$redirect_url.'">
+			<input type="hidden" name="redirect_url" value="'.htmlspecialchars($redirect_url).'">
 			<input type="submit" value="Log in"><br />
 			<br />
 
@@ -494,7 +494,7 @@
 					$this->generateConfigForm('get_form');
 
 					$content = $this->printAll();
-					$content = '<form action="'.$this->action.'" method="post">'.$content.'<input type="submit" value="Write to localconf.php"><br /><br />
+					$content = '<form action="'.htmlspecialchars($this->action).'" method="post">'.$content.'<input type="submit" value="Write to localconf.php"><br /><br />
 					'.$this->fw('<strong>NOTICE: </strong>By clicking this button, localconf.php is updated with new values for the parameters listed above!<br />').'
 					</form>';
 					$this->output($this->outputWrapper($content));
@@ -653,7 +653,7 @@
 					<br />
 					<br />
 					<table border="0">
-					   <form action="'.$this->action.'" method="post">
+					   <form action="'.htmlspecialchars($this->action).'" method="post">
 					   	<tr>
 					   		<td valign="top" nowrap="nowrap"><strong>
 								  '.$this->fontTag2.'Username:</span></strong>
@@ -723,7 +723,7 @@
 <br />
 <br />
 					<table border="0">
-					   <form action="'.$this->action.'" method="post">
+					   <form action="'.htmlspecialchars($this->action).'" method="post">
 					   	<tr>
 					   		<td valign="top" nowrap="nowrap"><strong>
 								  '.$this->fontTag2.'
@@ -938,19 +938,19 @@
 				$wrap=array('<strong><span style="color:navy;">','</span></strong>');
 				$fileFound = 1;
 			} else {$wrap=array();}
-			$lines[]='<tr><td nowrap="nowrap"><a href="'.$this->action.'&TYPO3_INSTALL[typo3conf_files]='.rawurlencode($file).($this->allowFileEditOutsite_typo3conf_dir?'&TYPO3_INSTALL[FILE][EDIT_path]='.rawurlencode($this->INSTALL['FILE']['EDIT_path']):"").'">'.$this->fw($wrap[0].basename($file).$wrap[1].'&nbsp;&nbsp;&nbsp;').'</a></td><td>'.$this->fw(t3lib_div::formatSize(filesize($file))).'</td></tr>';
+			$lines[]='<tr><td nowrap="nowrap"><a href="'.htmlspecialchars($this->action.'&TYPO3_INSTALL[typo3conf_files]='.rawurlencode($file).($this->allowFileEditOutsite_typo3conf_dir?'&TYPO3_INSTALL[FILE][EDIT_path]='.rawurlencode($this->INSTALL['FILE']['EDIT_path']):"")).'">'.$this->fw($wrap[0].basename($file).$wrap[1].'&nbsp;&nbsp;&nbsp;').'</a></td><td>'.$this->fw(t3lib_div::formatSize(filesize($file))).'</td></tr>';
 		}
 		$fileList='<table border="0" cellpadding="0" cellspacing="0">'.implode('',$lines).'</table>';
 		$fileList.='<br />('.$EDIT_path.')';
 
 		if ($this->allowFileEditOutsite_typo3conf_dir)	{
-			$fileList.='<br /><form action="'.$this->action.'" method="post">
+			$fileList.='<br /><form action="'.htmlspecialchars($this->action).'" method="post">
 			'.PATH_site.'<input type="text" name="TYPO3_INSTALL[FILE][EDIT_path]" value="'.$this->INSTALL['FILE']['EDIT_path'].'"><input type="submit" name="" value="Set">
 			</form>';
 		}
 
 			// create link for deleting temp_CACHED files
-		$fileList .= '<br /><br /><a href="'.$this->action.'&TYPO3_INSTALL[delTempCached]=1">Delete temp_CACHED* files</a>';
+		$fileList .= '<br /><br /><a href="'.htmlspecialchars($this->action.'&TYPO3_INSTALL[delTempCached]=1').'">Delete temp_CACHED* files</a>';
 
 		if ($fileFound && @is_file($this->INSTALL['typo3conf_files']))	{
 			$this->headerStyle = '
@@ -963,7 +963,7 @@
 
 			$backupFile = $this->getBackupFilename($this->INSTALL['typo3conf_files']);
 			$fileContent = t3lib_div::getUrl($this->INSTALL['typo3conf_files']);
-			$this->contentBeforeTable.= '<form action="'.$this->action.'" method="post">'.(substr($this->INSTALL['typo3conf_files'],-1)!='~' && !strstr($this->INSTALL['typo3conf_files'],'_bak') ? '
+			$this->contentBeforeTable.= '<form action="'.htmlspecialchars($this->action).'" method="post">'.(substr($this->INSTALL['typo3conf_files'],-1)!='~' && !strstr($this->INSTALL['typo3conf_files'],'_bak') ? '
 				<input type="submit" name="TYPO3_INSTALL[SAVE_FILE]" value="Save file">&nbsp;' : '').'
 				<input type="submit" name="_close" value="Close">
 				<br />File: '.$this->INSTALL['typo3conf_files'].'
@@ -1194,7 +1194,7 @@
 		<select name="TYPO3_INSTALL[typo3temp_subdir]">'.$this->getSelectorOptions($subdirRegistry, $this->INSTALL['typo3temp_subdir']).'</select>
 		';
 
-		$form = '<form action="'.$this->action.'" method="post">'.$content.'
+		$form = '<form action="'.htmlspecialchars($this->action).'" method="post">'.$content.'
 
 		<input type="submit" value="Execute">
 		</form>
@@ -1285,7 +1285,7 @@
 		}
 
 		$content = '<select name="TYPO3_INSTALL[cleanup_type]">'.$this->getSelectorOptions($cleanupType).'</select> ';
-		$form = '<form action="'.$this->action.'" method="post">'.$content.'<input type="submit" value="Execute"></form>';
+		$form = '<form action="'.htmlspecialchars($this->action).'" method="post">'.$content.'<input type="submit" value="Execute"></form>';
 		$this->message($headCode,'Statistics','
 			Number cached image sizes: <strong>'.$cachedImageSizesCounter.'</strong><br />
 		'.$form,1);
@@ -1659,7 +1659,7 @@
 			case 'get_form':
 				$out='
 				You can check the mail() function by entering your email address here and press the button. You should then receive a testmail from test@test.test.<br /> Since almost all mails in TYPO3 are sent using the t3lib_htmlmail class, sending with this class can be tested by checking the box <strong>Test t3lib_htmlmail</strong> below. The return-path of the mail is set to null@'.t3lib_div::getIndpEnv('HTTP_HOST').'. Some mail servers won\'t send the mail if the host of the return-path is not resolved correctly.
-				<form action="'.$this->action.'" method="post"><input type="text" name="TYPO3_INSTALL[check_mail]"><br /><input type="checkbox" name="TYPO3_INSTALL[use_htmlmail]" id="use_htmlmail" ><label for="use_htmlmail">Test t3lib_htmlmail.</label>
+				<form action="'.htmlspecialchars($this->action).'" method="post"><input type="text" name="TYPO3_INSTALL[check_mail]"><br /><input type="checkbox" name="TYPO3_INSTALL[use_htmlmail]" id="use_htmlmail" ><label for="use_htmlmail">Test t3lib_htmlmail.</label>
 					<input type="submit" value="Send test mail"></form>';
 			break;
 			default:
@@ -1909,7 +1909,7 @@
 			$this->message($ext, 'Available ImageMagick/GraphicsMagick installations:','<table border="1" cellpadding="2" cellspacing="2">'.$theCode.'</table>',-1);
 		}
 		$this->message($ext, 'Search for ImageMagick:','
-			<form action="'.$this->action.'" method="post">
+			<form action="'.htmlspecialchars($this->action).'" method="post">
 				<input type="checkbox" name="TYPO3_INSTALL[checkIM][lzw]" id="checkImLzw" value="1"'.($this->INSTALL['checkIM']['lzw']?' checked="checked"':'').'> <label for="checkImLzw">Check LZW capabilities.</label>
 
 				Check this path for ImageMagick installation:
@@ -2073,7 +2073,7 @@
 			case 'get_form':
 					// Database:
 				$out='
-				<form name="setupGeneral" action="'.$this->action.'" method="post">
+				<form name="setupGeneral" action="'.htmlspecialchars($this->action).'" method="post">
 				<table border="0" cellpadding="0" cellspacing="0">';
 
 				$out.=$this->wrapInCells('Username:', '<input type="text" name="TYPO3_INSTALL[localconf.php][typo_db_username]" value="'.htmlspecialchars(TYPO3_db_username?TYPO3_db_username:($this->config_array['sql.safe_mode_user']?$this->config_array['sql.safe_mode_user']:"")).'">'.($this->config_array['sql.safe_mode_user']?"<br />sql.safe_mode_user: <strong>".$this->config_array['sql.safe_mode_user']."</strong>":""));
@@ -2273,11 +2273,11 @@
 		if ($showOutput)	{
 			switch($returnVal)	{
 				case 'continue':
-					$content = '<br /><br />'.implode($this->messages,'<hr />').'<br /><br /><a href="'.$this->action.'">Click to continue...</a>';
+					$content = '<br /><br />'.implode($this->messages,'<hr />').'<br /><br /><a href="'.htmlspecialchars($this->action).'">Click to continue...</a>';
 					$this->outputExitBasedOnStep($content);
 				break;
 				case 'nochange':
-					$content = '<strong>Writing to \'localconf.php\':</strong><br /><br />No values were changed, so nothing is updated!<br /><br /><a href="'.$this->action.'">Click to continue...</a>';
+					$content = '<strong>Writing to \'localconf.php\':</strong><br /><br />No values were changed, so nothing is updated!<br /><br /><a href="'.htmlspecialchars($this->action).'">Click to continue...</a>';
 					$this->outputExitBasedOnStep('<br />'.$content);
 				break;
 			}
@@ -3426,7 +3426,7 @@
 		$directJump='';
 		while(list($k,$file)=each($sql_files))	{
 			if ($this->mode=="123" && !count($whichTables) && strstr($file,'_testsite'))	{
-				$directJump = $this->action.'&TYPO3_INSTALL[database_type]=import|'.rawurlencode($file);
+				$directJump = htmlspecialchars($this->action.'&TYPO3_INSTALL[database_type]=import|'.rawurlencode($file));
 			}
 			$lf=t3lib_div::testInt($k);
 			$fShortName = substr($file,strlen(PATH_site));
@@ -3836,7 +3836,7 @@
 
 									$this->isBasicComplete($headCode);
 
-									if ($result) {					
+									if ($result) {
 										$this->message($headCode,'User created','
 											Username: <strong>'.htmlspecialchars($username).'</strong><br />
 											Password: <strong>'.htmlspecialchars($pass).'</strong><br />',
@@ -4028,7 +4028,7 @@
 				if ($updateWizardBoxes)	{
 					$updateWizardBoxes = '<table><tr><td>'.$updateWizardBoxes.'</td></tr></table>';
 					$content = '
-						<form action="'.$this->action.'#bottom" method="post">
+						<form action="'.htmlspecialchars($this->action).'#bottom" method="post">
 							<input type="hidden" name="TYPO3_INSTALL[database_type]" value="'.htmlspecialchars('getUserInput').'">
 							'.$updateWizardBoxes.'</form>';
 				} else {
@@ -4217,7 +4217,7 @@
 	 * @return	[type]		...
 	 */
 	function getUpdateDbFormWrap($action_type, $content, $label='Write to database')	{
-		$form = '<form action="'.$this->action.'#bottom" method="post"><input type="hidden" name="TYPO3_INSTALL[database_type]" value="'.htmlspecialchars($action_type).'">'.$content.'<br /><input type="submit" value="'.$label.'">';
+		$form = '<form action="'.htmlspecialchars($this->action).'#bottom" method="post"><input type="hidden" name="TYPO3_INSTALL[database_type]" value="'.htmlspecialchars($action_type).'">'.$content.'<br /><input type="submit" value="'.$label.'">';
 		return $form;
 	}