Commit Graph

454 Commits (4.6.8)

Author SHA1 Message Date
Steven Wittens 92f05de1b6 - sa-2006-004: E-mail header injection issue 2006-03-13 21:29:57 +00:00
Steven Wittens 1f5025e5e3 - sa-2006-002: XSS issues with username 2006-03-13 21:28:05 +00:00
Steven Wittens 8acb44c544 - #41555: truncate_utf8 infinite loop on invalid utf-8 2006-02-09 08:57:47 +00:00
Dries Buytaert a48a57cac4 - Patch #46366 by rkerr: prevent infinite loops in 403 and 404 handling. 2006-02-01 14:34:26 +00:00
Dries Buytaert d56596be9e - Patch #39566 by chx: fixed incorrect encoding in URLs. 2005-12-02 10:30:59 +00:00
Dries Buytaert b7a55d67f5 - Patch #39494 by nsk: comment form not shown right. 2005-12-01 06:06:40 +00:00
Dries Buytaert 19d5a0a0e2 - Removed valid_input_check(). 2005-11-30 10:05:19 +00:00
Dries Buytaert 4155b0a525 - Various fixes. Updated CHANGELOG.txt 2005-11-29 20:14:29 +00:00
Steven Wittens b0cddd8a2c - Backporting http header fixes to 4.6 2005-10-28 01:57:36 +00:00
Dries Buytaert 3e37b385c2 - Patch #28482 by Uwe: added missing $ tags. 2005-08-18 05:21:04 +00:00
Steven Wittens ad4e2579af - Fix braino in doxygen. 2005-07-29 19:05:31 +00:00
Steven Wittens ad0cf415ca - #24278: Emit correct XHTML <link> tag. 2005-06-05 19:11:02 +00:00
Dries Buytaert 4cdeaa4b3a - Patch #24141: fix XML UTF-8 bom issue with PHP5.
Workaround for the fact that PHP5 cannot parse UTF-8 encoded XML feeds
    that start with the so-called "byte order mark".
2005-06-04 14:15:05 +00:00
Steven Wittens 38f93e2e8b - Code cleanup: improve format_plural usage, add some missing placeholder/check calls, and introduce API for <link> tags. 2005-05-31 21:13:45 +00:00
Steven Wittens ca84d2c13c - Fixing charset in mime_header_encode() 2005-05-30 18:09:08 +00:00
Steven Wittens f5017665f2 - #23700: Fix some broken t()'s in common.inc 2005-05-26 23:41:12 +00:00
Steven Wittens 010758b136 - Mime_header_encode() was buggy. Each chunk of encoded text must be
a valid UTF-8 string, beginning and ending on a character boundary.
2005-05-25 07:17:29 +00:00
Steven Wittens f06027a380 - #4166: Respect 'access userlist' permission for profile data. 2005-04-11 22:50:44 +00:00
Steven Wittens 52b7220a41 - Missing check_url() in form(). 2005-04-10 10:23:13 +00:00
Steven Wittens 6b40ba2f54 - #19874: Fix aggregator escaping after check_plain bug
- Fix bug in decode_entities() with double-escaped entities.
2005-04-07 22:47:25 +00:00
Dries Buytaert 97bfa01725 - Patch #18828 by me, jbond and TDobes: moves the textarea hook for 'pre' between the title and the textarea. This makes it easier for simply textarea enhancements like quicktags to add a toolbar just above the textarea. 2005-04-06 07:43:10 +00:00
Steven Wittens be14203534 - #18817: Clean up plain-text checking (see drupal-devel!) 2005-03-31 09:25:33 +00:00
Dries Buytaert 99233a9c99 - Patch #19590 by Moshe: lazy initialization of the theme system. Improves
performance of pages that don't need the theme system (such as RSS feeds)
  and makes it easier to set a custom theme.
2005-03-29 21:01:47 +00:00
Dries Buytaert 6957d7863d - Patch #19212 by chx: removed unused variables, and fixed the error reporting
in form_file().
2005-03-21 19:26:47 +00:00
Steven Wittens 0a984f2c2b - #18597: Resolve conflict in column name between queue.module and poll.module. 2005-03-18 07:34:07 +00:00
Dries Buytaert 42a085c8ad - Patch #18437 by Mathias: Drupal doesn't allow URL aliases that map to Userland Manila posts since they usually contain the '$' and are considered an invalid URL. This patch allows '$' in an URL and thus an alias. It also resolves a disparity between the 'allowable characters' of absolute and relative URLs. As far as I can tell, those parts of the regexp should be the same. 2005-03-06 06:57:58 +00:00
Dries Buytaert f7b8f53577 - Ignore PHP5's strict warnings for now. The real solution is to rewrite both xmlrpc.inc and xtemplate.inc. 2005-03-03 20:13:20 +00:00
Steven Wittens 36aaecd27e - Moving comment 2005-03-03 20:08:02 +00:00
Steven Wittens e68280064e - #18319: Move encoding conversion out of drupal_xml_parser_create() so it can be used by modules. 2005-03-03 20:06:42 +00:00
Steven Wittens a5b8a0a8fb - Removing dead variable 2005-02-09 17:33:53 +00:00
Steven Wittens 7fe195a07e - PHP5 fix due object references: node previewing should not put node output into form. 2005-02-04 20:14:05 +00:00
Dries Buytaert fbec279e4c - Patch #16246 by Moshe: added mechanism to direct the user back to the referring page after completing a form.
(Moshe: the patch against node.module failed to apply.)
2005-02-01 19:45:58 +00:00
Dries Buytaert 7ccc5a6b1b - Patch #16358 by James: added toolkit to enable better image handling. The avatar code and the upload module have been updated to take advantage of the new image API.
There are 5 main functions that modules may now utilize to handle images:

* image_get_info() - this function checks a file.  If it exists and is a valid image file, it will return an array containing things like the pixel dimensions of the image, plus the 'type' and common extension.
* image_scale - resizes a given image to fit within a given width / height dimensions, while maintaining aspect ratio (not distorting the image).  This function can be used to generate thumbnails, or ensure a maximum resolution, etc.
* image_resize - similar to image_scale (but will not respect aspect ratio - may well distort the image).
* image_rotate - rotate an image by X degrees
* image_crop - crops an image to a given rectangle (defined as top-left x/y coordinates plus a width & height of the rectangle).

Contribution modules will now be able to rely on these base manipulation functions to offer additional functionality (such as image nodes, photo galleries, advanced image manipulation, etc).
2005-02-01 16:27:43 +00:00
Dries Buytaert 7931c778d7 - Patch #16513 by James (slightly modified): export categories and enclosures to RSS feeds (and made RSS feeds extensible).
NOTE: this needs to be documented.
2005-02-01 14:09:31 +00:00
Dries Buytaert 7988f875a9 - Fixed PHP5 warning: the $result object in drupal_http_request() needed to be properly initialized using 'new StdClass'.
(I just installed PHP 5.0.3, no less.  Why don't you?)
2005-01-22 11:15:24 +00:00
Steven Wittens a1579a3aee - Reversing bad commit, sorry everyone. 2005-01-17 18:56:11 +00:00
Steven Wittens b45bd13d44 - Various code style fixes 2005-01-17 00:41:35 +00:00
Dries Buytaert e7777956f9 - Watchdog improvement: added a 'view' link for 'access denied' messages. 2005-01-10 20:25:34 +00:00
Dries Buytaert 64b100d19a - Patch #13260 by UnConeD: watchdog module improvements.
We added a 'severity' column to watchdog():
    watchdog($type, $message, $link) --> watchdog($type, $message, $severity, $link);

    * Specify a severity in case you are reporting a warning or error.
    * The $link-parameter is now the fourth parameter instead of the third.

  TODO: document this in the upgrade guide.
2005-01-09 09:22:40 +00:00
Dries Buytaert 828be2ad61 - Patch #13020 by chx: let Drupal handle multiple database layers.
- Removed the PEAR database backend.  It's no longer being used/maintained.
2004-12-30 13:13:22 +00:00
Dries Buytaert 0fb0a93965 - Improved the input checking. 2004-12-28 11:04:24 +00:00
Steven Wittens 7132e7d528 #14757: Fix XSS vulnerability due to entity usage. 2004-12-25 14:57:39 +00:00
Dries Buytaert 2b17b3a966 - Patch #13907 by Neil: less ways to set the page title.
* Less logic in theme code.
   * Encourages use of the menu system.
   * Easier to find where a title or breadcrumb comes from in other people's code because there are less places to look. Look in menu and then grep for the appropriate set function. Looking for calls to theme_page() is hard because there are too many of them.
   * Very slightly more efficient.
2004-12-15 21:19:42 +00:00
Dries Buytaert 60352821bf - Refactored the queue module: removed the queue module's field from the node table. With help from Gerhard.
- Slight addition to INSTALL.txt with regard to PHP versions.

- Updated/reworded some node type descriptions as per Boris' suggestions.

- Adding missing {} around a table name in update.php.
2004-12-07 16:55:38 +00:00
Dries Buytaert 6a95a00259 - Patch #7058 by Neil: format_date does not properly handle escaped characters. 2004-12-03 20:38:22 +00:00
Dries Buytaert 3cd9a1b2d4 - Patch #13405 by Moshe: make you actually do something useful with the init hook. A recent patch to 4.5 and HEAD made this patch run too early in the request (for non-cached pages). 2004-12-01 22:16:50 +00:00
Dries Buytaert 95610bdd6c - Patch #13647 by Goba:
1. Fixed broken watchdog calls: two watchdog calls omitted the type parameter, and thus injected logs into the type field, instead of the message field.
   2. Removed t() functions from user contributed content.
2004-11-29 17:52:35 +00:00
Dries Buytaert 70fcf51e84 - Refactored the statistics and watchdog module (views). The most important
changes are:

  1. Simplified the statistics pages: there are less pages and on the
     remaining pages there is a lot less visual clutter (less columns and
     better presentation).

  2. Reorganized the 'administer - logs' menu: flattened the menu structure
     and removed a number of links.

  3. Improved performance.  Most statistics pages used about 160 slow SQL
     queries which made the statistics pages fairly unusable on my system.
     The new pages use at least 10 times less SQL queries and render much
     faster.  They are actually usable.

  4. There is now a 'track'-tab on node pages, and a second subtrab on the
     user accounts 'track'-tab for people with the 'access statistics'
     permission.  They can be used to resp. track the node and the user.
     This makes the statistics more accessible.

  5. Changed the way watchdog messages are filtered.  This makes it easier
     to introduce new watchdog types.

  6. Reworked the statistics module's permissions.

  7. Less code: 223 insertions(+), 343 deletions(-).

  8. Fixed several glitches: for example, the statistics pages sorted the
     'Name' column by user ID instead of by name.  Unfortunately, it is
     too difficult to backport these to DRUPAL-4-5.

  TODO:

  1. Review the statistics modules help pages.

  2. Help fine-tune the interfaces/views.

  NOTES:

  1. You'll want to run update.php.
2004-11-28 12:28:35 +00:00
Dries Buytaert 5d0dfeb562 - Patch #13405 by Moshe:
+ Make bootstrap functionality work with HEAD.
   + Move functions into bootstrap.inc so that statistics_exit() works for cached pages.  (Does this close any issues?)
2004-11-25 06:14:59 +00:00
Dries Buytaert 4e4e2aa777 - Patch #13443 by Moshe: got rid of the semi-implemented 'page link' feature. All themes currently support primary and secondary links so page links are now deprecated. Check your contributed modules and update them accordingly. 2004-11-24 22:50:25 +00:00