Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #2140459 by amateescu, larowlan, David_Rothstein: Color module XSS in appearance settings.

8.0.x
webchick 2013-11-22 15:38:10 -08:00
parent 15a9a70046
commit 6deedddba3
1 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
core/modules/color/color.module
View File

@ -215,6 +215,7 @@ function color_scheme_form($complete_form, &$form_state, $theme) {
$form['palette'][$name] = array(
'#type' => 'textfield',
'#title' => check_plain($names[$name]),
'#value_callback' => 'color_palette_color_value',
'#default_value' => $value,
'#size' => 8,
'#attributes' => array('dir' => 'ltr'),
@ -254,6 +255,52 @@ function template_preprocess_color_scheme_form(&$variables) {
$variables['html_preview'] = file_get_contents($preview_html_path);
}
/**
* Determines the value for a palette color field.
*
* @param array $element
* The form element whose value is being populated.
* @param string|bool $input
* The incoming input to populate the form element. If this is FALSE,
* the element's default value should be returned.
* @param array $form_state
* A keyed array containing the current state of the form.
*
* @return string
* The data that will appear in the $form_state['values'] collection for this
* element. Return nothing to use the default.
*/
function color_palette_color_value($element, $input = FALSE, $form_state = array()) {
// If we suspect a possible cross-site request forgery attack, only accept
// hexadecimal CSS color strings from user input, to avoid problems when this
// value is used in the JavaScript preview.
if ($input !== FALSE) {
// Start with the provided value for this textfield, and validate that if
// necessary, falling back on the default value.
$value = form_type_textfield_value($element, $input, $form_state);
if (!$value || !isset($form_state['complete form']['#token']) || color_valid_hexadecimal_string($value) || drupal_valid_token($form_state['values']['form_token'], $form_state['complete form']['#token'])) {
return $value;
}
else {
return $element['#default_value'];
}
}
}
/**
* Determines if a hexadecimal CSS color string is valid.
*
* @param string $color
* The string to check.
*
* @return bool
* TRUE if the string is a valid hexadecimal CSS color string, or FALSE if it
* isn't.
*/
function color_valid_hexadecimal_string($color) {
return preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color);
}
/**
* Form validation handler for color_scheme_form().
*
@ -262,7 +309,7 @@ function template_preprocess_color_scheme_form(&$variables) {
function color_scheme_form_validate($form, &$form_state) {
// Only accept hexadecimal CSS color strings to avoid XSS upon use.
foreach ($form_state['values']['palette'] as $key => $color) {
if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
if (!color_valid_hexadecimal_string($color)) {
form_set_error('palette][' . $key, t('You must enter a valid hexadecimal color value for %name.', array('%name' => $form['color']['palette'][$key]['#title'])));
}
}