Change record status: 
Project: 
Introduced in branch: 
6.x
Introduced in version: 
6.x-1.7
Description: 

In order to secure the Echo module from exploits, the following changes were made:

  1. All $_REQUEST data is now sanitized by filter_xss().
  2. The echo_themed_page() function now stores a hash of its arguments in the cache. The _echo_access() function checks for the existence of this cache entry ensure that the request was indeed generated by echo_themed_page() and not by an external source.

This means that the Echo module now depends on a working cache implementation.

Also, some external resources which were rendered by the previous versions will now be stripped by filter_xss().

Impacts: 
Module developers