Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
When using the book reorder page at admin/content/book/(nid)
with JS disabled, it is possible to enter invalid parent ids, either out of the current book or even nonexistent.
book_admin_edit_validate()
should not only check for a modified array, but also for the validity of the submitted plid columns.
Steps to reproduce
Enable Book module
Create a few book pages and place them in a new book
Turn off javascript
Look for ways to insert the wrong parent id in the book edit form
Look for ways to insert the wrong parent id in the book overview form
Comment | File | Size | Author |
---|---|---|---|
#2 | book_validate1.patch | 1.73 KB | fgm |
#1 | book_validate.patch | 1.77 KB | fgm |
Comments
Comment #1
fgmSuggested patch adds two checks
- there is at least one child under the book root
- all nodes are children of another node in the book hierarchy
Comment #2
fgmOops, wrong patch.
Comment #3
criticalpatch CreditAttribution: criticalpatch commented#2: book_validate1.patch queued for re-testing.
Comment #4
thedavidmeister CreditAttribution: thedavidmeister commentedThis is still an issue in D8, so bumping the version number.
There is no node right below the book root in this reordering, the changes could not be saved.
Reads a bit colloquially to me. How about:
"There is no node below the book root with this ordering, the changes could not be saved."
We need descriptions for each of these, and instead of "mixed" we need to state the possible data types.
Comment #13
larowlan\Drupal\book\Form\BookAdminEditForm::validateForm
no longer referenceplid
I think that means this can be moved back to Drupal 7?
Comment #14
darvanenFollowed the step to reproduce I've just added to the IS using 9.3.x, couldn't reproduce. Agree this can go back to D7.