Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Dave Reid’s picture

Status: Active » Needs review
FileSize
3.21 KB
moshe weitzman’s picture

'title' => check_plain(format_username($account)),

won't that give you entity coded A tag with brackets and such? i can't think of an alternative though.

Dave Reid’s picture

Status: Needs review » Needs work

Yep I think you're right. I'll re-roll.

salvis’s picture

Maybe something like check_plain(decode_entities(strip_tags(format_username($account))))?

Dave Reid’s picture

The format username *should* be HTML free. All we need is just format_username($account)

Dave Reid’s picture

Status: Needs work » Needs review
FileSize
3.61 KB

So the only link that needed a check_plain() is the one that uses drupal_placeholder() because that calls check_plain() itself and uses 'html' => TRUE. All the other links do not have 'html' option defined, so in l() they will automatically have check_plain() applied. I tested with malicious HTML and it was all stripped out.

Dave Reid’s picture

Revised patch that also fixes the query builder for the switch user block.

Dave Reid’s picture

Forgot the u.status condition

salvis’s picture

Isn't what we see above between "Posted by" and "on December 12" the result of format_username()?

Dave Reid’s picture

no. format_username is just the username in D7.

salvis’s picture

Status: Needs review » Fixed

Tested and committed, thanks!

sun’s picture

Priority: Normal » Critical
Status: Fixed » Needs work
+++ devel.module	12 Dec 2010 17:13:32 -0000
@@ -728,23 +728,28 @@ function devel_switch_user_list() {
     $roles = user_roles(TRUE, 'switch users');
...
+      $or_condition->condition('r.rid', array_keys($roles), 'IN');

Upon initial installation, $roles is empty

=> Fatal error and nice WSOD. :(

Powered by Dreditor.

sun’s picture

More specifically:

PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')) ) ORDER BY u.access DESC LIMIT 10 OFFSET 0' at line 2: SELECT DISTINCT u.uid AS uid FROM {users} u LEFT OUTER JOIN {users_roles} r ON u.uid = r.uid WHERE (u.uid > :db_condition_placeholder_0) AND (u.status > :db_condition_placeholder_1) AND( (u.uid = :db_condition_placeholder_2) OR (r.rid IN ()) ) ORDER BY u.access DESC LIMIT 10 OFFSET 0; Array ( [:db_condition_placeholder_0] => 0 [:db_condition_placeholder_1] => 0 [:db_condition_placeholder_2] => 1 ) in devel_switch_user_list() (line 747 of sites/all/modules/devel/devel.module).

note the empty

OR (r.rid IN ()) )
sun’s picture

Status: Needs work » Needs review
FileSize
571 bytes

This should do the trick.

sun’s picture

Status: Needs review » Reviewed & tested by the community

Tested, works.

Dave Reid’s picture

Status: Reviewed & tested by the community » Fixed

Thanks, committed #14 to CVS.
http://drupal.org/cvs?commit=467946

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.