Problem/Motivation

If the theme query parameter contains a theme that does not exist the \Drupal\system\Controller\ThemeController should error with theme not found but when we added \Drupal\system\Controller\ThemeController::willInstallExperimentalTheme() we broke this because this expects theme to exist but $theme is user input (from the url query param) so this needs to be hardened.

Steps to reproduce

Copy a url to install a theme or set it as default and manipulate the theme value to be one that does not exist.

Proposed resolution

return FALSE from \Drupal\system\Controller\ThemeController::willInstallExperimentalTheme() if the theme does not exist.

Remaining tasks

User interface changes

None

Introduced terminology

N/a

API changes

None

Data model changes

None

Release notes snippet

N/a

Issue fork drupal-3572785

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

alexpott created an issue. See original summary.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Active » Needs review

I think this change might be simple enough to fall under the no test needed.

alexpott opened merge request !14727

borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Status: Needs review » Reviewed & tested by the community

I agree, this change is very simple.

  • catch committed 8be1747d on 11.3.x 
    fix: #3572785 \Drupal\system\Controller\ThemeController::...

  • catch committed e295bf68 on 11.x 
    fix: #3572785 \Drupal\system\Controller\ThemeController::...

  • catch committed 00727647 on main 
    fix: #3572785 \Drupal\system\Controller\ThemeController::...
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.3.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main, 11.x and 11.3.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

catch closed merge request !14727

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.