CVS edit link for BWPanda

I've developed a theme I'd like to contribute to the Drupal community.
It's called 'Scaccarium' (Latin for 'chessboard', or 'game of chess') and has a tableless, CSS-based, multi-column, variable-width layout with a chess theme.

You can view a working version of the theme here: http://dev.panda.id.au
And a screenshot of the site when logged in here: http://dev.panda.id.au/sites/dev.panda.id.au/files/screenshot.png

The inspiration for this theme was a free, Creative Commons-licensed CSS theme from TemplateWorld which you can view here.
Apart from one or two images I used directly, everything in the theme I created myself (and hereby license under the GPL).

One of the main reasons I have for wanting to submit and maintain a theme on Drupal.org, is that there are not many ready-to-use themes that actually look good (compared with the overall number of themes on D.O). I think Drupal needs more beautiful themes that users can download and use out-of-the-box, and I think this theme does that.

CommentFileSizeAuthor
#1 scaccarium.tar_.gz171.98 KBAnonymous (not verified)

Comments

Anonymous’s picture

Anonymous (not verified) commented
Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new scaccarium.tar_.gz171.98 KB

Theme tarball attached.

AjK’s picture

AjK commented
Status: Needs review » Needs work 
else if (!empty($link['title'])) {
        // Some links are actually not links, but we wrap these in <span> for adding title and class attributes
        if (empty($link['html'])) {
          $link['title'] = check_plain($link['title']);
        }
        $span_attributes = '';
        if (isset($link['attributes'])) {
          $span_attributes = drupal_attributes($link['attributes']);
        }
        $output .= '<span'. $span_attributes .'>'. $link['title'] .'</span>';
      }

Why is check_plain() only used if (empty($link['html'])) ? Seems to me that if you are going to use $link['title'] in $output you should unconditionally filter it to avoid any XSS problems. Could you explain more on this.

Anonymous’s picture

Anonymous (not verified) commented
Status: Needs work » Needs review

I didn't actually write that code. The only code from that function that I wrote was:

<?php
// Add extra <span> for Primary links
if ($attributes['class'] == 'links primary-links') {
  $output .= '<span class="bg-image">';
}
?>

and

<?php
// Close extra <span> for Primary links
if ($attributes['class'] == 'links primary-links') {
  $output .= '</span>';
}
?>

The rest I basically copied and pasted from: http://api.drupal.org/api/function/theme_links/6

If there's a security issue here, maybe a patch needs to be submitted to Drupal core...

AjK’s picture

AjK commented
Status: Needs review » Fixed

Looked closer at it and "html" is a flag to suppress check_plain() so in this case it's deliberate. So it's not a security issue.

Anonymous’s picture

Anonymous (not verified) commented

Great, thanks!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Component: Miscellaneous » new project application
Issue summary: View changes
Status: Closed (fixed) » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.