bachir/materio-base-legacy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security update for addressfiled_token

Browse Source
This commit is contained in:
Bachir Soussi Chiadmi 2015-04-19 21:20:32 +02:00
parent a1856277e5
commit e89afbf603
7 changed files with 100 additions and 117 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sites/all/modules/contrib/dev/addressfield_tokens/.gitignore vendored Normal file
View File

@ -0,0 +1,2 @@
.idea
*.patch

16
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.admin.inc
View File

@ -1,15 +1,7 @@
<?php <?php
// $Id$
/*
* Copyright © 2012 New Signature
*
* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
* You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
* You can contact New Signature by electronic mail at labs@newsignature.com -or- by U.S. Postal Service at 1100 H St. NW, Suite 940, Washington, DC 20005.
*/
/** /**
* @file Provides an Administrative UI for the addressfield_tokens module. * @file
* Provides an Administrative UI for the addressfield_tokens module.
*/ */
/** /**
@ -44,8 +36,8 @@ function addressfield_tokens_admin_form($form, &$form_state) {
foreach ($props as $name => $prop) { foreach ($props as $name => $prop) {
$form['addressfield_tokens_property_names'][$name] = array( $form['addressfield_tokens_property_names'][$name] = array(
'#type' => 'textfield', '#type' => 'textfield',
'#title' => $prop['label'], '#title' => check_plain($prop['label']),
'#description' => $name, '#description' => filter_xss($name),
'#default_value' => !empty($names[$name]) ? $names[$name] : $prop['label'], '#default_value' => !empty($names[$name]) ? $names[$name] : $prop['label'],
); );
} }

16
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.components.inc
View File

@ -1,15 +1,7 @@
<?php <?php
// $Id$
/*
* Copyright © 2012 New Signature
*
* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
* You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
* You can contact New Signature by electronic mail at labs@newsignature.com -or- by U.S. Postal Service at 1100 H St. NW, Suite 940, Washington, DC 20005.
*/
/** /**
* @file Webform Component information for an address field type * @file
* Webform Component information for an address field type
*/ */
/** /**
@ -22,7 +14,7 @@ function _webform_defaults_addressfield() {
return array( return array(
'name' => '', 'name' => '',
'form_key' => NULL, 'form_key' => NULL,
'mandatory' => 0, 'required' => 0,
'pid' => 0, 'pid' => 0,
'weight' => 0, 'weight' => 0,
'extra' => array( 'extra' => array(
@ -99,7 +91,7 @@ function _webform_render_addressfield($component, $value = NULL, $filter = TRUE)
'#attributes' => $component['extra']['attributes'], '#attributes' => $component['extra']['attributes'],
'#theme_wrappers' => array('webform_element'), '#theme_wrappers' => array('webform_element'),
'#description' => $filter ? _webform_filter_descriptions($component['extra']['description']) : $component['extra']['description'], '#description' => $filter ? _webform_filter_descriptions($component['extra']['description']) : $component['extra']['description'],
'#required' => $component['mandatory'], '#required' => $component['required'],
'#weight' => $component['weight'], '#weight' => $component['weight'],
'#translatable' => array( '#translatable' => array(
'title', 'title',

14
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.info
View File

@ -1,24 +1,16 @@
; $Id$
; Copyright © 2012 New Signature
;
; This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
; This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
; You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
; You can contact New Signature by electronic mail at labs@newsignature.com <20>or- by U.S. Postal Service at 1100 H St. NW, Suite 940, Washington, DC 20005.
name = Address Field Tokens name = Address Field Tokens
description = Creates tokens for address fields, adds new addressfield renders, and adds webform integration. description = Creates tokens for address fields, adds new addressfield renders, and adds webform integration.
core = 7.x core = 7.x
package = Fields package = Fields
version = 7.x-1.0-dev
dependencies[] = addressfield dependencies[] = addressfield
dependencies[] = entity_token dependencies[] = entity_token
dependencies[] = token dependencies[] = token
; Information added by Drupal.org packaging script on 2014-05-14 ; Information added by Drupal.org packaging script on 2014-10-29
version = "7.x-1.4" version = "7.x-1.5"
core = "7.x" core = "7.x"
project = "addressfield_tokens" project = "addressfield_tokens"
datestamp = "1400081330" datestamp = "1414599829"

50
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.module
View File

@ -1,12 +1,7 @@
<?php <?php
/** /**
* @file * @file
* * Main components.
* Copyright 2011 New Signature
* http://www.newsignature.com
*
* @author Andrew Marcus
* @since Oct 4, 2011
*/ */
function addressfield_tokens_menu() { function addressfield_tokens_menu() {
@ -127,7 +122,7 @@ function addressfield_tokens_field_formatter_settings_summary($field, $instance,
if ($display['type'] == 'addressfield_components') { if ($display['type'] == 'addressfield_components') {
$comps = array_intersect_key(addressfield_tokens_components(), array_flip($settings['components'])); $comps = array_intersect_key(addressfield_tokens_components(), array_flip($settings['components']));
$sep = str_replace('\n', '<br/>', $settings['separator']); $sep = str_replace('\n', '<br/>', $settings['separator']);
$summary = implode($sep, $comps); $summary = filter_xss(implode($sep, $comps));
} }
return $summary; return $summary;
} }
@ -141,26 +136,28 @@ function addressfield_tokens_field_formatter_view($entity_type, $entity, $field,
switch ($display['type']) { switch ($display['type']) {
case 'addressfield_citystate': case 'addressfield_citystate':
$theme = array('addressfield_formatter__citystate', 'addressfield_formatter'); $theme = array('addressfield_formatter__citystate', 'addressfield_formatter');
foreach ($items as $delta => $item) {
if (!empty($item['country'])) { if (!empty($item['country'])) {
array_unshift($theme, 'addressfield_formatter__citystate__' . $item['country']); array_unshift($theme, 'addressfield_formatter__citystate__' . $item['country']);
} }
foreach ($items as $delta => $item) {
$element[$delta] = array( $element[$delta] = array(
'#theme' => $theme, '#theme' => $theme,
'#address' => $item, '#address' => array_map('filter_xss', $item),
); );
} }
break; break;
case 'addressfield_linear': case 'addressfield_linear':
$theme = array('addressfield_formatter__linear', 'addressfield_formatter'); $theme = array('addressfield_formatter__linear', 'addressfield_formatter');
foreach ($items as $delta => $item) {
if (!empty($item['country'])) { if (!empty($item['country'])) {
array_unshift($theme, 'addressfield_formatter__linear__' . $item['country']); array_unshift($theme, 'addressfield_formatter__linear__' . $item['country']);
} }
foreach ($items as $delta => $item) {
$element[$delta] = array( $element[$delta] = array(
'#theme' => $theme, '#theme' => $theme,
'#address' => $item, '#address' => array_map('filter_xss', $item),
); );
} }
break; break;
@ -171,7 +168,7 @@ function addressfield_tokens_field_formatter_view($entity_type, $entity, $field,
$country = _addressfield_tokens_country($item['country']); $country = _addressfield_tokens_country($item['country']);
$element[$delta] = array( $element[$delta] = array(
'#type' => 'markup', '#type' => 'markup',
'#markup' => $country, '#markup' => filter_xss($country),
'#prefix' => '<span class="addressfield-country">', '#prefix' => '<span class="addressfield-country">',
'#suffix' => '</span>', '#suffix' => '</span>',
); );
@ -185,7 +182,7 @@ function addressfield_tokens_field_formatter_view($entity_type, $entity, $field,
$state = _addressfield_tokens_state($item['country'], $item['administrative_area']); $state = _addressfield_tokens_state($item['country'], $item['administrative_area']);
$element[$delta] = array( $element[$delta] = array(
'#type' => 'markup', '#type' => 'markup',
'#markup' => $state, '#markup' => filter_xss($state),
'#prefix' => '<span class="addressfield-state">', '#prefix' => '<span class="addressfield-state">',
'#suffix' => '</span>', '#suffix' => '</span>',
); );
@ -195,17 +192,16 @@ function addressfield_tokens_field_formatter_view($entity_type, $entity, $field,
case 'addressfield_components': case 'addressfield_components':
$theme = array('addressfield_formatter__components', 'addressfield_formatter'); $theme = array('addressfield_formatter__components', 'addressfield_formatter');
$settings = $display['settings'];
foreach ($items as $delta => $item) {
if (!empty($item['country'])) { if (!empty($item['country'])) {
array_unshift($theme, 'addressfield_formatter__components__' . $item['country']); array_unshift($theme, 'addressfield_formatter__components__' . $item['country']);
} }
$settings = $display['settings'];
foreach ($items as $delta => $item) {
$element[$delta] = array( $element[$delta] = array(
'#theme' => $theme, '#theme' => $theme,
'#address' => $item, '#address' => array_map('filter_xss', $item),
'#components' => $settings['components'], '#components' => $settings['components'],
'#separator' => $settings['separator'], '#separator' => filter_xss($settings['separator']),
); );
} }
break; break;
@ -277,24 +273,26 @@ function _addressfield_tokens_country($country) {
// Country abbreviations will always be two uppercase letters. // Country abbreviations will always be two uppercase letters.
$country = drupal_strtoupper($country); $country = drupal_strtoupper($country);
if (!empty($country) && isset($countries[$country])) { if (!empty($country) && isset($countries[$country])) {
return $countries[$country]; return check_plain($countries[$country]);
} }
return $country; return check_plain($country);
} }
/** /**
* Gets the abbreviation of the country with the given name * Gets the abbreviation of the country with the given name
* *
* @param string The name of the country * @param string
* @return string $country The 2-letter abbreviation of the country, or FALSE. * The name of the country.
* @return string $country
* The 2-letter abbreviation of the country, or FALSE.
*/ */
function _addressfield_tokens_country_abbr($country) { function _addressfield_tokens_country_abbr($country) {
$countries = array_flip(array_map('strtolower', _addressfield_tokens_countries())); $countries = array_flip(array_map('strtolower', _addressfield_tokens_countries()));
if (isset($countries[strtolower($country)])) { if (isset($countries[strtolower($country)])) {
return $countries[strtolower($country)]; return check_plain($countries[strtolower($country)]);
} }
return $country; return check_plain($country);
} }
/** /**
@ -341,9 +339,9 @@ function _addressfield_tokens_state($country, $state) {
// State abbreviations will usually be two uppercase letters. // State abbreviations will usually be two uppercase letters.
$state = drupal_strtoupper($state); $state = drupal_strtoupper($state);
if (!empty($state) && !empty($states[$state])) { if (!empty($state) && !empty($states[$state])) {
return $states[$state]; return check_plain($states[$state]);
} }
return $state; return check_plain($state);
} }
/** /**

7
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.theme.inc
View File

@ -1,4 +1,9 @@
<?php <?php
/**
* @file
* Theme Controllers.
*/
/** /**
* Implements theme_field(); * Implements theme_field();
* *
@ -102,5 +107,5 @@ function theme_addressfield_formatter__components($vars) {
} }
} }
return filter_xss(implode($separator, $out)); return implode($separator, $out);
} }

40
sites/all/modules/contrib/dev/addressfield_tokens/addressfield_tokens.tokens.inc
View File

@ -1,14 +1,4 @@
<?php <?php
// $Id$
/*
* Copyright © 2012 New Signature
*
* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
* You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
* You can contact New Signature by electronic mail at labs@newsignature.com -or- by U.S. Postal Service at 1100 H St. NW, Suite 940, Washington, DC 20005.
*/
/** /**
* @file Provides token replacements for address fields. * @file Provides token replacements for address fields.
*/ */
@ -40,8 +30,6 @@ function addressfield_tokens_token_info_alter(&$info) {
foreach ($props as $field => $data) { foreach ($props as $field => $data) {
$fieldtoken = str_replace('_', '-', $field); $fieldtoken = str_replace('_', '-', $field);
$name = '';
$descr = '';
if (!empty($names[$field])) { if (!empty($names[$field])) {
$name = $names[$field]; $name = $names[$field];
@ -139,6 +127,7 @@ function addressfield_tokens_token_info_alter(&$info) {
*/ */
function addressfield_tokens_tokens($type, $tokens, array $data = array(), array $options = array()) { function addressfield_tokens_tokens($type, $tokens, array $data = array(), array $options = array()) {
$url_options = array(); $url_options = array();
// @todo: why are we setting $language_code and not using it?
if (isset($options['language'])) { if (isset($options['language'])) {
$url_options['language'] = $options['language']; $url_options['language'] = $options['language'];
$language_code = $options['language']->language; $language_code = $options['language']->language;
@ -146,18 +135,21 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
else { else {
$language_code = LANGUAGE_NONE; $language_code = LANGUAGE_NONE;
} }
$sanitize = !empty($options['sanitize']); $sanitize = !empty($options['sanitize']);
$replacements = array(); $replacements = array();
$last_original = NULL;
// Process address field tokens // Process address field tokens
if ($type == 'addressfield' && !empty($data['addressfield'])) { if ($type == 'addressfield' && !empty($data['addressfield'])) {
foreach ($tokens as $name => $original) { foreach ($tokens as $name => $original) {
$last_original = $original;
$name = str_replace('-', '_', $name); $name = str_replace('-', '_', $name);
$address = $data['addressfield']; $address = $data['addressfield'];
// If the address field exists, use it. // If the address field exists, use it.
if (isset($address[$name])) { if (isset($address[$name])) {
$replacements[$original] = $address[$name]; $replacements[$original] = $sanitize ? filter_xss($address[$name]) : $address[$name];
} }
else { else {
// Otherwise, it's a special token // Otherwise, it's a special token
@ -166,7 +158,7 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
$render = addressfield_generate($address, array('address'), array( $render = addressfield_generate($address, array('address'), array(
'mode' => 'render', 'mode' => 'render',
)); ));
$replacements[$original] = drupal_render($render); $replacements[$original] = $sanitize ? filter_xss(drupal_render($render)) : drupal_render($render);
break; break;
case 'text': case 'text':
@ -188,7 +180,7 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
if (!empty($address['country']) && $address['country'] != addressfield_tokens_default_country()) { if (!empty($address['country']) && $address['country'] != addressfield_tokens_default_country()) {
$out[2] = _addressfield_tokens_country($address['country']); $out[2] = _addressfield_tokens_country($address['country']);
} }
$replacements[$original] = implode("\n", $out); $replacements[$original] = $sanitize ? filter_xss(implode("\n", $out)) : implode("\n", $out);
break; break;
case 'city_state': case 'city_state':
@ -202,19 +194,29 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
if (!empty($address['country']) && $address['country'] != addressfield_tokens_default_country()) { if (!empty($address['country']) && $address['country'] != addressfield_tokens_default_country()) {
$out[] = _addressfield_tokens_country($address['country']); $out[] = _addressfield_tokens_country($address['country']);
} }
$replacements[$original] = implode(", ", $out); $replacements[$original] = $sanitize ? filter_xss(implode(", ", $out)) : implode(", ", $out);
break; break;
case 'state_name': case 'state_name':
if (!empty($address['administrative_area']) && !empty($address['country'])) { if (!empty($address['administrative_area']) && !empty($address['country'])) {
if ($sanitize) {
$replacements[$original] = filter_xss(_addressfield_tokens_state($address['country'], $address['administrative_area']));
}
else {
$replacements[$original] = _addressfield_tokens_state($address['country'], $address['administrative_area']); $replacements[$original] = _addressfield_tokens_state($address['country'], $address['administrative_area']);
} }
}
break; break;
case 'country_name': case 'country_name':
if (!empty($address['country'])) { if (!empty($address['country'])) {
if ($sanitize) {
$replacements[$original] = filter_xss(_addressfield_tokens_country($address['country']));
}
else {
$replacements[$original] = _addressfield_tokens_country($address['country']); $replacements[$original] = _addressfield_tokens_country($address['country']);
} }
}
break; break;
case 'mc_address': case 'mc_address':
@ -232,8 +234,8 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
} }
} }
} }
if (!isset($replacements[$original])) { if (!isset($replacements[$last_original])) {
$replacements[$original] = ''; $replacements[$last_original] = '';
} }
} }
else { else {
@ -252,7 +254,7 @@ function addressfield_tokens_tokens($type, $tokens, array $data = array(), array
} }
catch (EntityMetadataWrapperException $e) { catch (EntityMetadataWrapperException $e) {
// The property doesn't exist, so skip it. // The property doesn't exist, so skip it.
$replacements[$original] = ''; $replacements[$last_original] = '';
} }
} }
} }