Switch element does not check for the correct value

[schst]

The Switch element only checks, whether any value has been passed, not the one supplied in the value attribute:

// required & empty
if( isset( $this->attributes["required"] ) && $this->attributes["required"] == "yes" && strlen( $value ) == 0 )
{
    $this->addValidationError( 1 );
    return false;
}
return true;

This might lead to problems, as the user can pass any value to the element via the request. Possibly even a XSS issue!

[schst]

Seems this is no XSS vulnerability as the value is never displayed, but still it would be more secure to check, whether the correct value has been sent by the browser and not just any value.

[argh]

This is fixed in SVN.