echo_themed_page uses the rawurlencode() function to encode $title, $content and $theme before making it's httprequest.

The _echo_access() callback currently uses $_REQUEST['title'], $_REQUEST['theme'] and $_REQUEST['content']
to calculate it's key.

In cases where any of 'title', 'content' or 'theme' contain characters that are substituted by rawurlencode, the _echo_access() callback will return false because the calculated sha1 key will not match the one set in the echo_themed_page function.

I'm attaching a patch with the suggested change - I'm a bit rusty with patching so please check for formatting.

CommentFileSizeAuthor
echo-rawurldecode#0.patch535 bytesletapjar

Comments

jacob.embree’s picture

Version: 7.x-1.9 » 7.x-1.x-dev
Status: Active » Needs review