From 36a2c852c12fca4e68038887eb9c08b687d92baf Mon Sep 17 00:00:00 2001
From: Axel Rutz <axel.rutz@clever-systems.net>
Date: Tue, 23 Aug 2011 02:10:18 +0200
Subject: [PATCH 2/2] fix #1256978: drupal_valid_path with $dynamic_allowed buggy

---
 includes/path.inc           |    5 +++--
 modules/menu/menu.admin.inc |    2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/includes/path.inc b/includes/path.inc
index db60537..c2f5e5a 100644
--- a/includes/path.inc
+++ b/includes/path.inc
@@ -539,6 +539,9 @@ function path_get_admin_paths() {
  *   The path to check.
  * @param $dynamic_allowed
  *   Whether paths with menu wildcards (like user/%) should be allowed.
+ *   If so, they are checked directly against the menu_router table,
+ *   so you will e.g. find node/%/revision/% (which is in the router_table as is)
+ *   but NOT node/17/revision/% (which is a valid path but not in the router_table as is). 
  *
  * @return
  *   TRUE if it is a valid path AND the current user has access permission,
@@ -554,8 +557,6 @@ function drupal_valid_path($path, $dynamic_allowed = FALSE) {
   elseif ($dynamic_allowed && preg_match('/\/\%/', $path)) {
     // Path is dynamic (ie 'user/%'), so check directly against menu_router table.
     if ($item = db_query("SELECT * FROM {menu_router} where path = :path", array(':path' => $path))->fetchAssoc()) {
-      $item['link_path']  = $form_item['link_path'];
-      $item['link_title'] = $form_item['link_title'];
       $item['external']   = FALSE;
       $item['options'] = '';
       _menu_link_translate($item);
diff --git a/modules/menu/menu.admin.inc b/modules/menu/menu.admin.inc
index cb33cbb..d9d358f 100644
--- a/modules/menu/menu.admin.inc
+++ b/modules/menu/menu.admin.inc
@@ -381,7 +381,7 @@ function menu_edit_item_validate($form, &$form_state) {
       $item['link_path'] = $parsed_link['path'];
     }
   }
-  if (!trim($item['link_path']) || !drupal_valid_path($item['link_path'], TRUE)) {
+  if (!trim($item['link_path']) || !drupal_valid_path($item['link_path'])) {
     form_set_error('link_path', t("The path '@link_path' is either invalid or you do not have access to it.", array('@link_path' => $item['link_path'])));
   }
 }
-- 
1.7.4.1