Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
The following conditional checks if the $mod_base_url exists anywhere within the external js file path, rather than the actual base url of the filepath, which returns true for a url such as http://my.externaldomain.com/foo/{mod_base_url}/path/to/file.js, which is incorrect.
// If type is external and starts with http, https, or // but points to
// this host change to file, but move it to the top of the aggregation
// stack.
if ($value['type'] === 'external'
&& stripos($value['data'], $mod_base_url) !== FALSE
&& (stripos($value['data'], 'http://') === 0
|| stripos($value['data'], 'https://') === 0
|| strpos($value['data'], '//') === 0
)
) {
This should be validating that the $mod_base_url is actually the base url to the resource, and not just contained anywhere within $value['data'].
Suggested fix:
// If type is external and starts with http, https, or // but points to
// this host change to file, but move it to the top of the aggregation
// stack.
if ($value['type'] === 'external'
&& preg_match('#^(https?:)?//' . preg_quote($mod_base_url) . '#i', $value['data']) === 1
) {
Comment | File | Size | Author |
---|---|---|---|
#17 | advagg-2864421-17-fix-external-detection-logic.patch | 2.79 KB | mikeytown2 |
#14 | advagg-2864421-14-fix-external-detection-logic.patch | 725 bytes | ZhuRenTongKu |
Comments
Comment #2
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedComment #3
mikeytown2 CreditAttribution: mikeytown2 commentedGoing to test patch against latest dev
Comment #5
mikeytown2 CreditAttribution: mikeytown2 commentedTry again without escaping
Comment #7
mikeytown2 CreditAttribution: mikeytown2 commentedComment #11
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedI have updated the patch, please find attached.
Comment #12
mikeytown2 CreditAttribution: mikeytown2 commentedComment #14
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedHave updated patch by using 7.x-2.x branch
git clone git://git.drupal.org/project/advagg.git
applied changes to advagg.module
git diff > advagg-2864421-14-fix-external-detection-logic.patch
Comment #15
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedComment #16
mikeytown2 CreditAttribution: mikeytown2 commentedTypo (double slash) will fail with the new version
http://my.externaldomain.com/foo//{mod_base_url}/path/to/file.js
Going to look at this more.
Comment #17
mikeytown2 CreditAttribution: mikeytown2 commentedI think this solves the issue without the use of regex.
Comment #18
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedThanks for your prompt attention to this MikeyTown2 - Applying this to my codebase today, will report back shortly!
Comment #19
ZhuRenTongKu CreditAttribution: ZhuRenTongKu commentedThis seems to do the trick for me!
advagg-2864421-17-fix-external-detection-logic.patch = working as expected.
Comment #21
mikeytown2 CreditAttribution: mikeytown2 commentedGood to hear! It's been committed.