Forum OpenACS Q&A: Re: Security hole in ad_form (may change behavior of ad_form to fix!)

My solution is to not change ad_form, but make sure you use it right.

ad_form -extend ... -form [list $elm_name:$type($widget) { label $label } ... ]

May be too hard to explain properly in the docs?

It's only an issue when auto-generating forms using ad_form based on user input. The parameters issue is not critical, because only people with site-wide admin can add a package parameter.

/Lars