[VIM] Vendor ACK clarification for PHpNews auth.php / user

[Steven M. Christey]

reference: (CVE pending)

  BUGTRAQ:20050720 PHPNews SQL injection vulnerability
  URL:http://marc.theaimsgroup.com/?l=bugtraq&m=112189453304389&w=2
  CONFIRM:http://newsphp.sourceforge.net/changelog/changelog_1.30.txt

The changelog for 1.3.0 says "Possible SQL injection vulnerability."
However, a diff of auth.php between 1.2.6 and 1.3.0 shows the relevant
fixes:

74,83c74,75
<     if (!get_magic_quotes_gpc())
<     {
<       $in_user = addslashes($_POST['user']);
<       $in_password = addslashes($_POST['password']);
<     }
<     else
<     {
<       $in_user = $_POST['user'];
<       $in_password = $_POST['password'];
<     }
---
>     $in_user = $_POST['user'];
>     $in_password = $_POST['password'];


- Steve