flexinodes textarea field in the 4.6 version of the module isn't checking the filter_access of the user. so a user with permissions to post flexinode content including textarea fields is able to run php-code through the php-filter.
patch attached.
flexinode head shouldn't be affected as there is used check_plain instead of check_output, however imho it should use check_markup() as it displays the filter form...
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | flexiode_textarea_head.fix | 2.41 KB | fago |
| flexinode46-textarea-output.patch | 954 bytes | fago |
Comments
Comment #1
fagoComment #2
chx commentedI commited a fix which is quite different from this patch, i added a validate_hook.
Comment #3
fagothis patch fixes this issue by validation hook for flexinode head.
however the hook_access implementation needs to be updated to work with head.
Comment #4
fagoalready fixed in head, too.
Comment #5
(not verified) commented