By pillarsdotnet on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
6.x
Introduced in version:
6.x-1.7
Issue links:
Description:
In order to secure the Echo module from exploits, the following changes were made:
- All
$_REQUESTdata is now sanitized byfilter_xss(). - The
echo_themed_page()function now stores a hash of its arguments in the cache. The_echo_access()function checks for the existence of this cache entry ensure that the request was indeed generated byecho_themed_page()and not by an external source.
This means that the Echo module now depends on a working cache implementation.
Also, some external resources which were rendered by the previous versions will now be stripped by filter_xss().
Impacts:
Module developers