Index: includes/bootstrap.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v
retrieving revision 1.199
diff -u -r1.199 bootstrap.inc
--- includes/bootstrap.inc	11 Nov 2007 16:14:45 -0000	1.199
+++ includes/bootstrap.inc	22 Nov 2007 02:39:38 -0000
@@ -299,9 +299,8 @@
     // characters allowed in hostnames.
     $base_url = $base_root .= '://'. preg_replace('/[^a-z0-9-:._]/i', '', $_SERVER['HTTP_HOST']);
 
-    // $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
     // be modified by a visitor.
-    if ($dir = trim(dirname($_SERVER['SCRIPT_NAME']), '\,/')) {
+    if ($dir = trim(dirname(htmlentities($_SERVER['PHP_SELF'])), '\,/')) {
       $base_path = "/$dir";
       $base_url .= $base_path;
       $base_path .= '/';