Index: includes/bootstrap.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v retrieving revision 1.206.2.11 diff -u -p -r1.206.2.11 bootstrap.inc --- includes/bootstrap.inc 25 Feb 2009 13:49:54 -0000 1.206.2.11 +++ includes/bootstrap.inc 29 Apr 2009 23:02:30 -0000 @@ -791,6 +791,8 @@ function request_uri() { $uri = $_SERVER['SCRIPT_NAME']; } } + // Prevent multiple slashes to avoid cross site requests via the FAPI. + $uri = '/'. ltrim($uri, '/'); return $uri; } Index: includes/common.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/common.inc,v retrieving revision 1.756.2.48 diff -u -p -r1.756.2.48 common.inc --- includes/common.inc 25 Feb 2009 23:16:45 -0000 1.756.2.48 +++ includes/common.inc 29 Apr 2009 23:02:31 -0000 @@ -152,6 +152,15 @@ function drupal_get_headers() { } /** + * Make any final alterations to the rendered xhtml. + */ +function drupal_final_markup($content) { + // Make sure that the charset is always specified as the first element of the + // head region to prevent encoding-based attacks. + return preg_replace('/]*>/i', "\$0\n", $content, 1); +} + +/** * Add a feed URL for the current page. * * @param $url Index: includes/theme.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/theme.inc,v retrieving revision 1.415.2.20 diff -u -p -r1.415.2.20 theme.inc --- includes/theme.inc 29 Apr 2009 17:22:52 -0000 1.415.2.20 +++ includes/theme.inc 29 Apr 2009 23:02:31 -0000 @@ -687,6 +687,10 @@ function theme() { } // restore path_to_theme() $theme_path = $temp; + // Add final markup to the full page. + if ($hook == 'page') { + $output = drupal_final_markup($output); + } return $output; } Index: modules/system/maintenance-page.tpl.php =================================================================== RCS file: /cvs/drupal/drupal/modules/system/maintenance-page.tpl.php,v retrieving revision 1.2 diff -u -p -r1.2 maintenance-page.tpl.php --- modules/system/maintenance-page.tpl.php 24 Jan 2008 09:42:51 -0000 1.2 +++ modules/system/maintenance-page.tpl.php 29 Apr 2009 23:02:31 -0000 @@ -19,8 +19,8 @@ - <?php print $head_title; ?> + <?php print $head_title; ?> Index: modules/system/page.tpl.php =================================================================== RCS file: /cvs/drupal/drupal/modules/system/page.tpl.php,v retrieving revision 1.11 diff -u -p -r1.11 page.tpl.php --- modules/system/page.tpl.php 24 Jan 2008 09:42:51 -0000 1.11 +++ modules/system/page.tpl.php 29 Apr 2009 23:02:31 -0000 @@ -80,8 +80,8 @@ - <?php print $head_title; ?> + <?php print $head_title; ?> Index: themes/bluemarine/page.tpl.php =================================================================== RCS file: /cvs/drupal/drupal/themes/bluemarine/Attic/page.tpl.php,v retrieving revision 1.28 diff -u -p -r1.28 page.tpl.php --- themes/bluemarine/page.tpl.php 24 Jan 2008 09:42:52 -0000 1.28 +++ themes/bluemarine/page.tpl.php 29 Apr 2009 23:02:31 -0000 @@ -4,8 +4,8 @@ - <?php print $head_title ?> + <?php print $head_title ?> Index: themes/chameleon/chameleon.theme =================================================================== RCS file: /cvs/drupal/drupal/themes/chameleon/Attic/chameleon.theme,v retrieving revision 1.76 diff -u -p -r1.76 chameleon.theme --- themes/chameleon/chameleon.theme 24 Jan 2008 09:42:53 -0000 1.76 +++ themes/chameleon/chameleon.theme 29 Apr 2009 23:02:31 -0000 @@ -30,8 +30,8 @@ function chameleon_page($content, $show_ $output = "\n"; $output .= "\n"; $output .= "\n"; - $output .= " ". ($title ? strip_tags($title) ." | ". variable_get("site_name", "Drupal") : variable_get("site_name", "Drupal") ." | ". variable_get("site_slogan", "")) ."\n"; $output .= drupal_get_html_head(); + $output .= " ". ($title ? strip_tags($title) ." | ". variable_get("site_name", "Drupal") : variable_get("site_name", "Drupal") ." | ". variable_get("site_slogan", "")) ."\n"; $output .= drupal_get_css(); $output .= drupal_get_js(); $output .= ""; Index: themes/garland/maintenance-page.tpl.php =================================================================== RCS file: /cvs/drupal/drupal/themes/garland/maintenance-page.tpl.php,v retrieving revision 1.3 diff -u -p -r1.3 maintenance-page.tpl.php --- themes/garland/maintenance-page.tpl.php 24 Jan 2008 09:42:53 -0000 1.3 +++ themes/garland/maintenance-page.tpl.php 29 Apr 2009 23:02:31 -0000 @@ -15,8 +15,8 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - <?php print $head_title ?> + <?php print $head_title ?>