Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

- Patch #829822 by pwolanin, tstoeckler: check Drupal 7 core for vulnerabilities in SA-CONTRIB-2010-066.

merge-requests/26/head
Dries Buytaert 2010-08-17 21:31:13 +00:00
parent 946a8d5967
commit 2d3af8fe80
4 changed files with 20 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
includes/file.inc
View File

@ -331,9 +331,9 @@ function file_stream_wrapper_get_instance_by_scheme($scheme) {
*
* @return
* A string containing a URL that may be used to access the file.
* If the provided string already contains a preceding 'http', nothing is done
* and the same string is returned. If a valid stream wrapper could not be
* found to generate an external URL, then FALSE will be returned.
* If the provided string already contains a preceding 'http', 'https', or
* '/', nothing is done and the same string is returned. If a stream wrapper
* could not be found to generate an external URL, then FALSE is returned.
*/
function file_create_url($uri) {
// Allow the URI to be altered, e.g. to serve a file from a CDN or static
@ -355,8 +355,8 @@ function file_create_url($uri) {
}
else {
// If this is not a properly formatted stream, then it is a shipped file.
// Therefor, return the URI with the base URL prepended.
return $GLOBALS['base_url'] . '/' . $uri;
// Therefore, return the urlencoded URI with the base URL prepended.
return $GLOBALS['base_url'] . '/' . drupal_encode_path($uri);
}
}
elseif ($scheme == 'http' || $scheme == 'https') {

9
modules/simpletest/tests/common.test
View File

@ -749,8 +749,9 @@ class CascadingStylesheetsTestCase extends DrupalWebTestCase {
*/
function testAddCssFileWithQueryString() {
$this->drupalGet('common-test/query-string');
$query_string = substr(variable_get('css_js_query_string', '0'), 0, 1);
$this->assertRaw(drupal_get_path('module', 'node') . '/node.css?arg1=value1&arg2=value2&' . $query_string, t('Query string was appended correctly to css.'));
$query_string = variable_get('css_js_query_string', '0');
$this->assertRaw(drupal_get_path('module', 'node') . '/node.css?' . $query_string, t('Query string was appended correctly to css.'));
$this->assertRaw(drupal_get_path('module', 'node') . '/node-fake.css?arg1=value1&arg2=value2', t('Query string not escaped on a URI.'));
}
}
@ -1354,8 +1355,8 @@ class JavaScriptTestCase extends DrupalWebTestCase {
*/
function testAddJsFileWithQueryString() {
$this->drupalGet('common-test/query-string');
$query_string = substr(variable_get('css_js_query_string', '0'), 0, 1);
$this->assertRaw(drupal_get_path('module', 'node') . '/node.js?arg1=value1&arg2=value2&' . $query_string, t('Query string was appended correctly to js.'));
$query_string = variable_get('css_js_query_string', '0');
$this->assertRaw(drupal_get_path('module', 'node') . '/node.js?' . $query_string, t('Query string was appended correctly to js.'));
}
}

6
modules/simpletest/tests/common_test.module
View File

@ -220,7 +220,9 @@ function common_test_library() {
* Adds a JavaScript file and a CSS file with a query string appended.
*/
function common_test_js_and_css_querystring() {
drupal_add_js(drupal_get_path('module', 'node') . '/node.js?arg1=value1&arg2=value2');
drupal_add_css(drupal_get_path('module', 'node') . '/node.css?arg1=value1&arg2=value2');
drupal_add_js(drupal_get_path('module', 'node') . '/node.js');
drupal_add_css(drupal_get_path('module', 'node') . '/node.css');
// A relative URI may have a query string.
drupal_add_css('/' . drupal_get_path('module', 'node') . '/node-fake.css?arg1=value1&arg2=value2');
return '';
}

12
modules/system/system.tokens.inc
View File

@ -202,7 +202,7 @@ function system_tokens($type, $tokens, array $data = array(), array $options = a
break;
case 'raw':
$replacements[$original] = filter_xss($date);
$replacements[$original] = $sanitize ? check_plain($date) : $date;
break;
}
}
@ -230,15 +230,15 @@ function system_tokens($type, $tokens, array $data = array(), array $options = a
break;
case 'description':
$replacements[$original] = $sanitize ? filter_xss($file->description) : $file->description;
$replacements[$original] = $sanitize ? check_plain($file->description) : $file->description;
break;
case 'path':
$replacements[$original] = $sanitize ? filter_xss($file->uri) : $file->uri;
$replacements[$original] = $sanitize ? check_plain($file->uri) : $file->uri;
break;
case 'mime':
$replacements[$original] = $sanitize ? filter_xss($file->filemime) : $file->filemime;
$replacements[$original] = $sanitize ? check_plain($file->filemime) : $file->filemime;
break;
case 'size':
@ -246,7 +246,7 @@ function system_tokens($type, $tokens, array $data = array(), array $options = a
break;
case 'url':
$replacements[$original] = url(file_create_url($file->uri), $url_options);
$replacements[$original] = $sanitize ? check_plain(file_create_url($file->uri)) : file_create_url($file->uri);
break;
// These tokens are default variations on the chained tokens handled below.
@ -256,7 +256,7 @@ function system_tokens($type, $tokens, array $data = array(), array $options = a
case 'owner':
$account = user_load($file->uid);
$replacements[$original] = $sanitize ? filter_xss($account->name) : $account->name;
$replacements[$original] = $sanitize ? check_plain($account->name) : $account->name;
break;
}
}