Comments

avpaderno’s picture

Hello, and thanks for applying for a CVS account.

As the module contains a security issue, you need to provide a patch that fixes the problem.

m_rookie’s picture

Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new1.32 KB

Attached is the patch that I believe solves the security issues.

greggles’s picture

This patch caught some things that were missed by the patch that had originally been provided by grendzy (of the security team, who found the issue).

Here was his patch:


Index: simplegallery.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/simplegallery/simplegallery.module,v
retrieving revision 1.9
diff -u -p -r1.9 simplegallery.module
--- simplegallery.module	31 Aug 2009 11:26:54 -0000	1.9
+++ simplegallery.module	20 Oct 2009 03:32:01 -0000
@@ -202,10 +202,10 @@ function simplegallery_all() {
                     $icount = $icount + count($cnode->{$imagefield});
                 }
                 
-                $page_content.= "<div class=\"simplegallery-term\">" . $term->name ." (" . $icount . ")</div><div class=\"simplegallery-showlink\">";
+                $page_content.= "<div class=\"simplegallery-term\">" . check_plain($term->name) ." (" . $icount . ")</div><div class=\"simplegallery-showlink\">";
             }
             else
-                $page_content.= "<div class=\"simplegallery-term\">" . $term->name . "</div><div class=\"simplegallery-showlink\">";
+                $page_content.= "<div class=\"simplegallery-term\">" . check_plain($term->name) . "</div><div class=\"simplegallery-showlink\">";
             $page_content.= l(t("Show All"), "gallery/" . $term->tid);
             $page_content.= "</div><br /><div class=\"simplegallery-teaserimages\">";
             $rows = array();
@@ -265,7 +265,7 @@ function simplegallery_sub($tid) {
         $nodes[] = $row->nid;
     }
     
-    drupal_set_title($term->name);
+    drupal_set_title(check_plain($term->name));
     drupal_set_breadcrumb(array(l(t('Home'), NULL), l(t('Gallery'), 'gallery')));
     $rows = array();
     $i = 0;

If the current patch is updated to include all of these fixes, I think it will be ready to be accepted (and therefore m_rookie's application will be ready to be accepted).

m_rookie’s picture

StatusFileSize
new2.32 KB

Here is the corrected patch with all the vulnerabilities I found and the additional ones pointed out to me.

avpaderno’s picture

Status: Needs review » Fixed

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

avpaderno’s picture

Component: Miscellaneous » new project application
Issue summary: View changes
avpaderno’s picture

Assigned: Unassigned » avpaderno