core update from 7.37 to 7.38
This commit is contained in:
@@ -2105,6 +2105,10 @@ function field_ui_next_destination($entity_type, $bundle) {
|
||||
$destinations = !empty($_REQUEST['destinations']) ? $_REQUEST['destinations'] : array();
|
||||
if (!empty($destinations)) {
|
||||
unset($_REQUEST['destinations']);
|
||||
}
|
||||
// Remove any external URLs.
|
||||
$destinations = array_diff($destinations, array_filter($destinations, 'url_is_external'));
|
||||
if ($destinations) {
|
||||
return field_ui_get_destinations($destinations);
|
||||
}
|
||||
$admin_path = _field_ui_bundle_admin_path($entity_type, $bundle);
|
||||
|
@@ -6,8 +6,8 @@ core = 7.x
|
||||
dependencies[] = field
|
||||
files[] = field_ui.test
|
||||
|
||||
; Information added by Drupal.org packaging script on 2015-05-07
|
||||
version = "7.37"
|
||||
; Information added by Drupal.org packaging script on 2015-08-19
|
||||
version = "7.39"
|
||||
project = "drupal"
|
||||
datestamp = "1430973154"
|
||||
datestamp = "1440020197"
|
||||
|
||||
|
@@ -445,6 +445,19 @@ class FieldUIManageFieldsTestCase extends FieldUITestCase {
|
||||
$this->assertText(t('The machine-readable name is already in use. It must be unique.'));
|
||||
$this->assertUrl($url, array(), 'Stayed on the same page.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests that external URLs in the 'destinations' query parameter are blocked.
|
||||
*/
|
||||
function testExternalDestinations() {
|
||||
$path = 'admin/structure/types/manage/article/fields/field_tags/field-settings';
|
||||
$options = array(
|
||||
'query' => array('destinations' => array('http://example.com')),
|
||||
);
|
||||
$this->drupalPost($path, NULL, t('Save field settings'), $options);
|
||||
|
||||
$this->assertUrl('admin/structure/types/manage/article/fields', array(), 'Stayed on the same site.');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
|
Reference in New Issue
Block a user