update core to 7.36
This commit is contained in:
@@ -7,8 +7,8 @@ files[] = filter.test
|
||||
required = TRUE
|
||||
configure = admin/config/content/formats
|
||||
|
||||
; Information added by Drupal.org packaging script on 2014-05-08
|
||||
version = "7.28"
|
||||
; Information added by Drupal.org packaging script on 2015-04-02
|
||||
version = "7.36"
|
||||
project = "drupal"
|
||||
datestamp = "1399522731"
|
||||
datestamp = "1427943826"
|
||||
|
||||
|
@@ -348,9 +348,7 @@ function filter_permission() {
|
||||
foreach (filter_formats() as $format) {
|
||||
$permission = filter_permission_name($format);
|
||||
if (!empty($permission)) {
|
||||
// Only link to the text format configuration page if the user who is
|
||||
// viewing this will have access to that page.
|
||||
$format_name_replacement = user_access('administer filters') ? l($format->name, 'admin/config/content/formats/' . $format->format) : drupal_placeholder($format->name);
|
||||
$format_name_replacement = l($format->name, 'admin/config/content/formats/' . $format->format);
|
||||
$perms[$permission] = array(
|
||||
'title' => t("Use the !text_format text format", array('!text_format' => $format_name_replacement,)),
|
||||
'description' => drupal_placeholder(t('Warning: This permission may have security implications depending on how the text format is configured.')),
|
||||
|
@@ -68,7 +68,7 @@ function theme_filter_tips($variables) {
|
||||
foreach ($tips as $name => $tiplist) {
|
||||
if ($multiple) {
|
||||
$output .= '<div class="filter-type filter-' . drupal_html_class($name) . '">';
|
||||
$output .= '<h3>' . $name . '</h3>';
|
||||
$output .= '<h3>' . check_plain($name) . '</h3>';
|
||||
}
|
||||
|
||||
if (count($tiplist) > 0) {
|
||||
|
@@ -70,6 +70,15 @@ class FilterCRUDTestCase extends DrupalWebTestCase {
|
||||
$this->assertFalse($db_format->status, 'Database: Disabled text format is marked as disabled.');
|
||||
$formats = filter_formats();
|
||||
$this->assertTrue(!isset($formats[$format->format]), 'filter_formats: Disabled text format no longer exists.');
|
||||
|
||||
// Add a new format to check for Xss in format name.
|
||||
$format = new stdClass();
|
||||
$format->format = 'xss_format';
|
||||
$format->name = '<script>alert(123)</script>';
|
||||
filter_format_save($format);
|
||||
user_role_change_permissions(DRUPAL_ANONYMOUS_RID, array(filter_permission_name($format) => 1));
|
||||
$this->drupalGet('filter/tips');
|
||||
$this->assertNoRaw($format->name, 'Text format name contains no xss.');
|
||||
}
|
||||
|
||||
/**
|
||||
|
Reference in New Issue
Block a user