Merge pull request #50 from greezybacon/feature/obfuscate-form-names

Use seemingly-random form input names

Reviewed-By: Peter Rotich <peter@osticket.com>

include/class.dynamic_forms.php

@@ -808,14 +808,15 @@ class SelectionWidget extends ChoicesWidget {
         ?>
         <span style="display:inline-block">
         <input type="text" size="30" name="<?php echo $this->name; ?>"
-            value="<?php echo $name; ?>" autocomplete="off" />
+            id="<?php echo $this->name; ?>" value="<?php echo $name; ?>"
+            autocomplete="off" />
         <script type="text/javascript">
         $(function() {
-            $('input[name=<?php echo $this->name; ?>]').typeahead({
+            $('input#<?php echo $this->name; ?>').typeahead({
                 source: <?php echo JsonDataEncoder::encode($source); ?>,
                 property: 'info',
                 onselect: function(item) {
-                    $('input[name="<?php echo $this->name; ?>"]').val(item['value'])
+                    $('input#<?php echo $this->name; ?>').val(item['value'])
                 }
             });
         });

include/class.forms.php

@@ -309,7 +309,8 @@ class FormField {
 
     function getFormName() {
         if (is_numeric($this->get('id')))
-            return '-field-id-'.$this->get('id');
+            return substr(md5(
+                session_id() . '-field-id-'.$this->get('id')), -16);
         else
             return $this->get('id');
     }