From e9f2f04956a9fc8ff63ff2ad4ba69d43831a53df Mon Sep 17 00:00:00 2001
From: Bob Vincent <bobvin@pillars.net>
Date: Sun, 16 Oct 2011 23:18:06 -0400
Subject: [PATCH] Issue #1311774 by pillarsdotnet: Prevent database access in
 path.inc if the database has not been loaded.

---
 includes/path.inc |   36 ++++++++++++++++++++++++++++++++++++
 1 files changed, 36 insertions(+), 0 deletions(-)

diff --git a/includes/path.inc b/includes/path.inc
index 630b34c4ce087cf74a50a10e96e2bf41aa29608e..4b97d8424e16f58cf70f2486716a9822382e39dc 100644
--- a/includes/path.inc
+++ b/includes/path.inc
@@ -43,6 +43,10 @@ function drupal_path_initialize() {
  *   found.
  */
 function drupal_lookup_path($action, $path = '', $path_language = NULL) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return FALSE;
+  }
   global $language_url;
   // Use the advanced drupal_static() pattern, since this is called very often.
   static $drupal_static_fast;
@@ -201,6 +205,10 @@ function drupal_lookup_path($action, $path = '', $path_language = NULL) {
  * drupal_lookup_path().
  */
 function drupal_cache_system_paths() {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return;
+  }
   // Check if the system paths for this page were loaded from cache in this
   // request to avoid writing to cache on every request.
   $cache = &drupal_static('drupal_lookup_path', array());
@@ -233,6 +241,10 @@ function drupal_cache_system_paths() {
  *   found.
  */
 function drupal_get_path_alias($path = NULL, $path_language = NULL) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return $path;
+  }
   // If no path is specified, use the current page's path.
   if ($path == NULL) {
     $path = $_GET['q'];
@@ -257,6 +269,10 @@ function drupal_get_path_alias($path = NULL, $path_language = NULL) {
  *   internal path was found.
  */
 function drupal_get_normal_path($path, $path_language = NULL) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return $path;
+  }
   $original_path = $path;
 
   // Lookup the path alias first.
@@ -377,6 +393,10 @@ function drupal_path_alias_whitelist_rebuild($source = NULL) {
   // path it corresponds to. This is the portion of the path before the first
   // '/', if present, otherwise the whole path itself.
   $whitelist = array();
+  // Abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return $whitelist;
+  }
   $result = db_query("SELECT DISTINCT SUBSTRING_INDEX(source, '/', 1) AS path FROM {url_alias}");
   foreach ($result as $row) {
     $whitelist[$row->path] = TRUE;
@@ -401,6 +421,10 @@ function drupal_path_alias_whitelist_rebuild($source = NULL) {
  *   - language: The language of the alias.
  */
 function path_load($conditions) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return FALSE;
+  }
   if (is_numeric($conditions)) {
     $conditions = array('pid' => $conditions);
   }
@@ -431,6 +455,10 @@ function path_load($conditions) {
  *   - language: (optional) The language of the alias.
  */
 function path_save(&$path) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return;
+  }
   $path += array('pid' => NULL, 'language' => LANGUAGE_NONE);
 
   // Insert or update the alias.
@@ -455,6 +483,10 @@ function path_save(&$path) {
  *   A number representing the pid or an array of criteria.
  */
 function path_delete($criteria) {
+  // Immediately abort if the database has not been loaded.
+  if (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    return;
+  }
   if (!is_array($criteria)) {
     $criteria = array('pid' => $criteria);
   }
@@ -551,6 +583,10 @@ function drupal_valid_path($path, $dynamic_allowed = FALSE) {
   if ($path == '<front>' || url_is_external($path)) {
     $item = array('access' => TRUE);
   }
+  // Abort if the database has not been loaded.
+  elseif (drupal_get_bootstrap_phase() < DRUPAL_BOOTSTRAP_DATABASE) {
+    $item = FALSE;
+  }
   elseif ($dynamic_allowed && preg_match('/\/\%/', $path)) {
     // Path is dynamic (ie 'user/%'), so check directly against menu_router table.
     if ($item = db_query("SELECT * FROM {menu_router} where path = :path", array(':path' => $path))->fetchAssoc()) {
-- 
1.7.5.4