When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the "Administer themes" permission.

This issue affects Drupal 6.x and 7.x.

http://drupal.org/node/1168756

Comments

johnbarclay’s picture

johnbarclay commented
Status: Active » Needs review

color changes in patchs:

  1. 7.1: http://drupalcode.org/project/drupal.git/commitdiff/316bd96ebff36284f5f3...
  2. 6.1
    http://drupalcode.org/project/drupal.git/blobdiff/8636b1234c84a07f0f087c...
  3. 6.1 http://drupalcode.org/project/drupal.git/blobdiff/8636b1234c84a07f0f087c...

Looks like the update looks through the database and checks for unsafe data in db. The patch to the color module simply adds another form validation to the color_scheme_form. All three look like they will map directly from the d6 patch to d5 with the only change being the update number in color.install being 5001.

I'll apply and test them and make a patch. Does this seem correct?