There is a bug with the up and down buttons in iMenu which manifests itself if register_globals is turned off in PHP (and that's been the default setting for a while now).

The up and down buttons don't work because the move() function in the admin/index.php file relies on $id and $weight being defined from params sent through the GET method, but that file does not explicitly define params sent from GET. Therefore, if register_globals is off, then the up and down buttons don't work.

To fix, just add these two lines (or similar) right before the call to im_admin_move (around line 32):

$id = $_GET['id'];
$weight = $_GET['weight'];

--Julian

While you're at it, you could also sanitize them:



That's assuming they're supposed to be integers, and they're not sanitized elsewhere.

That's a good point. They are not sanitized elsewhere.

--Julian