summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwebchick2011-05-25 13:07:13 -0700
committerwebchick2011-05-25 13:07:13 -0700
commit316bd96ebff36284f5f3e33268760ff9c672b6f8 (patch)
tree9cf884400848933c21eb03d90631b04c97f7543d
parent497914920385b7016ac9c9367e0198530787adf2 (diff)
Drupal 7.17.1
-rw-r--r--CHANGELOG.txt5
-rw-r--r--includes/bootstrap.inc2
-rw-r--r--modules/color/color.install15
-rw-r--r--modules/color/color.module13
-rw-r--r--modules/file/file.module2
5 files changed, 34 insertions, 3 deletions
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index e568504..ea91e0d 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,4 +1,7 @@
-// $Id$
+
+Drupal 7.1, 2011-05-25
+----------------------
+- Fixed security issues (Cross site scripting, File access bypass), see SA-CORE-2011-001.
Drupal 7.0, 2011-01-05
----------------------
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index be9813c..fb73528 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -9,7 +9,7 @@
/**
* The current system version.
*/
-define('VERSION', '7.0');
+define('VERSION', '7.1');
/**
* Core API compatibility.
diff --git a/modules/color/color.install b/modules/color/color.install
index 0655e79..ff1e835 100644
--- a/modules/color/color.install
+++ b/modules/color/color.install
@@ -41,3 +41,18 @@ function color_requirements($phase) {
return $requirements;
}
+
+/**
+ * Warn site administrator if unsafe CSS color codes are found in the database.
+ */
+function color_update_7001() {
+ $theme_palettes = db_query("SELECT name FROM {variable} WHERE name LIKE 'color_%_palette'")->fetchCol();
+ foreach ($theme_palettes as $name) {
+ $palette = variable_get($name, array());
+ foreach ($palette as $key => $color) {
+ if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+ drupal_set_message('Some of the custom CSS color codes specified via the color module are invalid. Please examine the themes which are making use of the color module at the <a href="'. url('admin/appearance/settings') .'">Appearance settings</a> page to verify their CSS color values.', 'warning');
+ }
+ }
+ }
+}
diff --git a/modules/color/color.module b/modules/color/color.module
index d94cadc..ab8fb9b 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -43,6 +43,7 @@ function color_form_system_theme_settings_alter(&$form, &$form_state) {
'#theme' => 'color_scheme_form',
);
$form['color'] += color_scheme_form($form, $form_state, $theme);
+ $form['#validate'][] = 'color_scheme_form_validate';
$form['#submit'][] = 'color_scheme_form_submit';
}
}
@@ -272,6 +273,18 @@ function theme_color_scheme_form($variables) {
}
/**
+ * Validation handler for color change form.
+ */
+function color_scheme_form_validate($form, &$form_state) {
+ // Only accept hexadecimal CSS color strings to avoid XSS upon use.
+ foreach ($form_state['values']['palette'] as $key => $color) {
+ if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+ form_set_error('palette][' . $key, t('%name must be a valid hexadecimal CSS color value.', array('%name' => $form['color']['palette'][$key]['#title'])));
+ }
+ }
+}
+
+/**
* Submit handler for color change form.
*/
function color_scheme_form_submit($form, &$form_state) {
diff --git a/modules/file/file.module b/modules/file/file.module
index 13a8024..3b6e185 100644
--- a/modules/file/file.module
+++ b/modules/file/file.module
@@ -976,7 +976,7 @@ function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISI
}
}
- return isset($field) ? $references[$field['field_name']] : $references;
+ return isset($field) ? $references[$field['field_name']] : array_filter($references);
}
/**