SA-CORE-2009-001: Access bypass in translation.module

untested

Rerolled for HEAD with a few newlines added for readability.

Doh. Nothing changes in translation.module since March, then 30 minutes after I submit a patch, it gets updated...

Oh well, found a few things that needed to be changed when I looked at it again with fresh eyes. New patch attached.

That's what I get for submitting patches before I've had my morning coffee.

I need to get simpletest running on my machine...

Ok, I officially give up for now.

The failing portion is below:

// If user has no access to the filter used for the body, Drupal core
+    // does not let the edit form to appear, so we should avoid exposing
+    // the source text here too.
+    $formats = filter_formats();
+    $node->body = filter_access($formats[$source_node->body['zxx'][0]['format']]) ? $source_node->body : '';

If someone knows how to get at the format for the node body, that is all that is preventing this one from passing all the tests.

The failing portion is below:

<?php
// If user has no access to the filter used for the body, Drupal core
+    // does not let the edit form to appear, so we should avoid exposing
+    // the source text here too.
+    $formats = filter_formats();
+    $node->body = filter_access($formats[$source_node->body['zxx'][0]['format']]) ? $source_node->body : '';
?>

Should use $source_node->language as the key to get body from the source node. Because the source node body could be any language.

<?php
$node->body[$node->language][0] = (filter_access($formats[$source_node->body[$source_node->language][0]['format']])) ? $source_node->body[$source_node->language][0] : '';
?>

I think...

don't know what i was thinking should just assign $source_node->body to $node->body.
Changed the following:

<?php 
$node->body = (filter_access($formats[$source_node->body[$source_node->language][0]['format']])) ? $source_node->body : '';
?>

@grndlvl

Thanks for finishing this one off. I just couldn't seem to get that section right!

Anyways, it looks good to me, and is a faithful adaption of the D6 patch.

Tests passed, setting back to RTBC.

Committed to HEAD, thanks!