bachir/materio-base-legacy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

7.16 less patch previous patches are preserved

Browse Source 
Signed-off-by: bachy <git@g-u-i.net>
This commit is contained in:
bachy
2012-10-26 21:57:49 +02:00
parent e5028b4522
commit 4240ab47e8
125 changed files with 409 additions and 369 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
modules/openid/openid.inc
View File

@@ -138,8 +138,28 @@ function openid_redirect_form($form, &$form_state, $url, $message) {
*/
function _openid_xrds_parse($raw_xml) {
$services = array();
try {
$xml = @new SimpleXMLElement($raw_xml);
// For PHP version >= 5.2.11, we can use this function to protect against
// malicious doctype declarations and other unexpected entity loading.
// However, we will not rely on it, and reject any XML with a DOCTYPE.
$disable_entity_loader = function_exists('libxml_disable_entity_loader');
if ($disable_entity_loader) {
$load_entities = libxml_disable_entity_loader(TRUE);
}
// Load the XML into a DOM document.
$dom = new DOMDocument();
@$dom->loadXML($raw_xml);
// Since DOCTYPE declarations from an untrusted source could be malicious, we
// stop parsing here and treat the XML as invalid since XRDS documents do not
// require, and are not expected to have, a DOCTYPE.
if (isset($dom->doctype)) {
return array();
}
// Parse the DOM document for the information we need.
if ($xml = simplexml_import_dom($dom)) {
foreach ($xml->children(OPENID_NS_XRD)->XRD as $xrd) {
foreach ($xrd->children(OPENID_NS_XRD)->Service as $service_element) {
$service = array(
@@ -165,9 +185,12 @@ function _openid_xrds_parse($raw_xml) {
}
}
}
catch (Exception $e) {
// Invalid XML.
// Return the LIBXML options to the previous state before returning.
if ($disable_entity_loader) {
libxml_disable_entity_loader($load_entities);
}
return $services;
}

6
modules/openid/openid.info
View File

@@ -5,8 +5,8 @@ package = Core
core = 7.x
files[] = openid.test
; Information added by drupal.org packaging script on 2012-08-01
version = "7.15"
; Information added by drupal.org packaging script on 2012-10-17
version = "7.16"
project = "drupal"
datestamp = "1343839327"
datestamp = "1350508567"

9
modules/openid/openid.test
View File

@@ -180,6 +180,15 @@ class OpenIDFunctionalTestCase extends OpenIDWebTestCase {
// Verify user was redirected away from user/login to an accessible page.
$this->assertResponse(200);
$this->drupalLogout();
// Use a User-supplied Identity that is the URL of an XRDS document.
// Tell the test module to add a doctype. This should fail.
$identity = url('openid-test/yadis/xrds', array('absolute' => TRUE, 'query' => array('doctype' => 1)));
// Test logging in via the login block on the front page.
$edit = array('openid_identifier' => $identity);
$this->drupalPost('', $edit, t('Log in'));
$this->assertRaw(t('Sorry, that is not a valid OpenID. Ensure you have spelled your ID correctly.'), 'XML with DOCTYPE was rejected.');
}
/**

6
modules/openid/tests/openid_test.info
View File

@@ -6,8 +6,8 @@ core = 7.x
dependencies[] = openid
hidden = TRUE
; Information added by drupal.org packaging script on 2012-08-01
version = "7.15"
; Information added by drupal.org packaging script on 2012-10-17
version = "7.16"
project = "drupal"
datestamp = "1343839327"
datestamp = "1350508567"

6
modules/openid/tests/openid_test.module
View File

@@ -109,7 +109,11 @@ function openid_test_yadis_xrds() {
}
}
drupal_add_http_header('Content-Type', 'application/xrds+xml');
print '<?xml version="1.0" encoding="UTF-8"?>
print '<?xml version="1.0" encoding="UTF-8"?>';
if (!empty($_GET['doctype'])) {
print "\n<!DOCTYPE dct [ <!ELEMENT blue (#PCDATA)> ]>\n";
}
print '
<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)" xmlns:openid="http://openid.net/xmlns/1.0">
<XRD>
<Status cid="' . check_plain(variable_get('openid_test_canonical_id_status', 'verified')) . '"/>