The _nodewords_prepare_path() function does not check the system base path when it trims the value submitted as the URL value.

Files: 
CommentFileSizeAuthor
#2 nodewords-n1697936-2.patch1.88 KBDamienMcKenna
PASSED: [[SimpleTest]]: [MySQL] 127 pass(es). View
#1 nodewords-n1697936.patch1.71 KBDamienMcKenna
PASSED: [[SimpleTest]]: [MySQL] 127 pass(es). View

Comments

DamienMcKenna’s picture

Status: Active » Needs review
FileSize
1.71 KB
PASSED: [[SimpleTest]]: [MySQL] 127 pass(es). View

I think this should do it. Rather than simply removing the slash from the start of the URL, it removes the base_path().

DamienMcKenna’s picture

FileSize
1.88 KB
PASSED: [[SimpleTest]]: [MySQL] 127 pass(es). View

A slight correction - it should use drupal_strlen() instead of strlen(), given it's already using drupal_substr().

DamienMcKenna’s picture

Committed.

DamienMcKenna’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.