From 4f857c8ecff52e7b0a1e1cb18a28f20bd52cac70 Mon Sep 17 00:00:00 2001
From: istenrot <istenrot@1317414.no-reply.drupal.org>
Date: Tue, 11 Oct 2016 13:32:42 -0400
Subject: [PATCH 1/2] Issue #2816405 by ilari.stenroth: Warn admin users on
 site status report page if insecure webforms are found

---
 webform.install | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/webform.install b/webform.install
index 46c0f61..3f41741 100644
--- a/webform.install
+++ b/webform.install
@@ -729,6 +729,42 @@ function webform_requirements($phase) {
     );
   }
 
+  if ($phase != 'install') {
+    $file_components = array();
+
+    $file_upload_security_issues = 0;
+    $nodes = array();
+    $query = db_select('webform', 'w');
+    $query->join('node', 'n', 'w.nid = n.nid');
+    $query->fields('n');
+    $nodes = $query->execute()->fetchAllAssoc('nid');
+    foreach ($nodes as $nid => $node) {
+      $file_upload_security_issue_found = FALSE;
+      $node = node_load($nid);
+      if (in_array(DRUPAL_ANONYMOUS_RID, $node->webform['roles'])) {
+        foreach ($node->webform['components'] as $cid => $component) {
+          if ($component['type'] == 'file') {
+            if ($component['extra']['scheme'] == 'public') {
+              $file_upload_security_issue_found = TRUE;
+            }
+          }
+        }
+      }
+      if ($file_upload_security_issue_found == TRUE) {
+        $file_upload_security_issues++;
+      }
+    }
+
+    if ($file_upload_security_issues > 0) {
+      $requirements['webform_upload_security'] = array(
+        'title' => $t('Webform insecure file uploads'),
+        'value' => $t('DANGER! @count insecure Webform(s) found!', array('@count' => $file_upload_security_issues)),
+        'severity' => REQUIREMENT_ERROR,
+        'description' => $t('Public files upload destination is dangerous for webforms that are available for anonymous users.') . ' ' . t('More info: ') . '<a href="https://www.drupal.org/psa-2016-003">DRUPAL-PSA-2016-003<a>' ,
+      );
+    }
+  }
+
   return $requirements;
 }
 
-- 
2.9.2


From ffdf6bc3aa38079521818c871d1432689574a06c Mon Sep 17 00:00:00 2001
From: vinmassaro <vinmassaro@525104.no-reply.drupal.org>
Date: Tue, 11 Oct 2016 13:34:21 -0400
Subject: [PATCH 2/2] Issue #2816405 by vinmassaro: Warn admin users on site
 status report page if insecure webforms are found

---
 webform.install | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/webform.install b/webform.install
index 3f41741..c6cc60d 100644
--- a/webform.install
+++ b/webform.install
@@ -746,6 +746,7 @@ function webform_requirements($phase) {
           if ($component['type'] == 'file') {
             if ($component['extra']['scheme'] == 'public') {
               $file_upload_security_issue_found = TRUE;
+              $insecure_webform_nodes['items'][] = t($node->title . ' ' . '<a href="@url">(view)</a>', array('@url' => '/node/' . $node->nid . '/webform'));
             }
           }
         }
@@ -755,10 +756,17 @@ function webform_requirements($phase) {
       }
     }
 
+    $insecure_webform_nodes = array(
+      'items' => array_unique($insecure_webform_nodes['items']),
+      'title' => '',
+      'type' => 'ol',
+      'attributes' => array(),
+    );
+
     if ($file_upload_security_issues > 0) {
       $requirements['webform_upload_security'] = array(
         'title' => $t('Webform insecure file uploads'),
-        'value' => $t('DANGER! @count insecure Webform(s) found!', array('@count' => $file_upload_security_issues)),
+        'value' => $t('DANGER! @count insecure Webform(s) found! <br /> !links', array('@count' => $file_upload_security_issues, '!links' => theme('item_list', $insecure_webform_nodes))),
         'severity' => REQUIREMENT_ERROR,
         'description' => $t('Public files upload destination is dangerous for webforms that are available for anonymous users.') . ' ' . t('More info: ') . '<a href="https://www.drupal.org/psa-2016-003">DRUPAL-PSA-2016-003<a>' ,
       );
-- 
2.9.2