Hi guys,

The plain text filtering using the Custom Filter does not quote the content of the text one enters. This means something that looks like this:

[url=
[link=

fails with a PHP error and subsequent problems of having an error. The preg_match() call needs the string to be escaped first. You can have a look at the PHP documentation here:

http://us2.php.net/manual/en/function.preg-quote.php

Please, make sure to apply the patch! Many people may be affected by this if then entered text with periods (i.e. 1.2.3.4 to block an IP address.)

Thank you.
Alexis

CommentFileSizeAuthor
spam-6.x-custom_plain.patch720 bytesAlexisWilke

Comments

jeremy’s picture

Status: Needs review » Fixed

Thanks, fix tested and committed:
http://drupal.org/cvs?commit=468958

AlexisWilke’s picture

Status: Fixed » Needs work

Jeremy,

You removed the '/' in the preg_quote() which is a problem. If what is being quoted includes a / then it will fail.

Thank you.
Alexis

gnassar’s picture

Status: Needs work » Fixed

Status: Fixed » Closed (fixed)
Issue tags: -regular expression

Automatically closed -- issue fixed for 2 weeks with no activity.