=== modified file 'includes/path.inc' --- includes/path.inc +++ includes/path.inc @@ -10,6 +10,8 @@ * executing "drupal_bootstrap(DRUPAL_BOOTSTRAP_PATH);". */ +define(DANGEROUS_ARG_RETRIEVE, '/'); + /** * Initialize the $_GET['q'] variable to the proper normal path. */ @@ -121,11 +123,14 @@ function drupal_get_normal_path($path) { } /** - * Return a component of the current Drupal path. + * Return or compare a component of the current Drupal path. * - * When viewing a page at the path "admin/node/configure", for example, arg(0) - * would return "admin", arg(1) would return "node", and arg(2) would return - * "configure". + * When viewing a page at the path "admin/node/configure", for example, + * arg(0, 'admin') would return TRUE, so would arg(1, 'node'). For the path + * 'node/123', arg(1) would return 123. You can also retrieve the argument as + * a string by using the DANGEROUS_ARG_RETRIEVE constant as the second parameter, + * but always include a comment so that anyone who looks at the code, knows + * where it is checked. * * Avoid use of this function where possible, as resulting code is hard to read. * Instead, attempt to use named arguments in menu callback functions. See the @@ -134,12 +139,16 @@ function drupal_get_normal_path($path) { * @param $index * The index of the component, where each component is separated by a '/' * (forward-slash), and where the first component has an index of 0 (zero). + * @param $compare + * A string to compare against or DANGEROUS_ARG_RETRIEVE to grab the arg as + * it is given. See comments above. * * @return - * The component specified by $index, or FALSE if the specified component was - * not found. + * If the asked for argument does not exist, then NULL. An integer if $compare + * is not set, a boolean if $compare is set and the argument itself is $compare + * is DANGEROUS_ARG_RETRIEVE. */ -function arg($index) { +function arg($index, $compare = NULL) { static $arguments, $q; if (empty($arguments) || $q != $_GET['q']) { @@ -148,7 +157,10 @@ function arg($index) { } if (isset($arguments[$index])) { - return $arguments[$index]; + if ($compare == DANGEROUS_ARG_RETRIEVE) { + return $arguments[$index]; + } + return isset($compare) ? $arguments[$index] == $compare : (int)$arguments[$index]; } } === modified file 'includes/theme.inc' --- includes/theme.inc +++ includes/theme.inc @@ -46,7 +46,7 @@ function init_theme() { // Allow modules to override the present theme... only select custom theme // if it is available in the list of installed themes. - $theme = $custom_theme && $themes[$custom_theme] ? $custom_theme : $theme; + $theme = ($custom_theme && isset($themes[$custom_theme]) && $themes[$custom_theme]) ? $custom_theme : $theme; // Store the identifier for retrieving theme settings with. $theme_key = $theme; === modified file 'modules/aggregator.module' --- modules/aggregator.module +++ modules/aggregator.module @@ -110,8 +110,8 @@ function aggregator_menu($may_cache) { } } else { - if (arg(0) == 'aggregator' && is_numeric(arg(2))) { - if (arg(1) == 'sources') { + if (arg(0, 'aggregator') && arg(2)) { + if (arg(1, 'sources')) { $feed = aggregator_get_feed(arg(2)); if ($feed) { $items[] = array('path' => 'aggregator/sources/'. $feed['fid'], @@ -137,7 +137,7 @@ function aggregator_menu($may_cache) { 'weight' => 1); } } - else if (arg(1) == 'categories') { + else if (arg(1, 'categories')) { $category = aggregator_get_category(arg(2)); if ($category) { $items[] = array('path' => 'aggregator/categories/'. $category['cid'] .'/view', @@ -159,8 +159,8 @@ function aggregator_menu($may_cache) { } } } - else if (arg(1) == 'aggregator' && is_numeric(arg(4))) { - if (arg(3) == 'feed') { + else if (arg(1, 'aggregator') && arg(4)) { + if (arg(3, 'feed')) { $feed = aggregator_get_feed(arg(4)); if ($feed) { $items[] = array('path' => 'admin/aggregator/edit/feed/'. $feed['fid'], @@ -363,7 +363,7 @@ function aggregator_form_category_submit if (isset($form_values['cid'])) { if (isset($form_values['title'])) { drupal_set_message(t('The category %category has been updated.', array('%category' => theme('placeholder', $form_values['title'])))); - if (arg(0) == 'admin') { + if (arg(0, 'admin')) { return 'admin/aggregator/'; } else { @@ -373,7 +373,7 @@ function aggregator_form_category_submit else { watchdog('aggregator', t('Category %category deleted.', array('%category' => theme('placeholder', $title)))); drupal_set_message(t('The category %category has been deleted.', array('%category' => theme('placeholder', $title)))); - if (arg(0) == 'admin') { + if (arg(0, 'admin')) { return 'admin/aggregator/'; } else { @@ -496,7 +496,7 @@ function aggregator_form_feed_submit($fo if (isset($form_values['fid'])) { if (isset($form_values['title'])) { drupal_set_message(t('The feed %feed has been updated.', array('%feed' => theme('placeholder', $form_values['title'])))); - if (arg(0) == 'admin') { + if (arg(0, 'admin')) { return 'admin/aggregator/'; } else { @@ -506,7 +506,7 @@ function aggregator_form_feed_submit($fo else { watchdog('aggregator', t('Feed %feed deleted.', array('%feed' => theme('placeholder', $title)))); drupal_set_message(t('The feed %feed has been deleted.', array('%feed' => theme('placeholder', $title)))); - if (arg(0) == 'admin') { + if (arg(0, 'admin')) { return 'admin/aggregator/'; } else { @@ -1080,10 +1080,10 @@ function _aggregator_page_list($sql, $op // arg(1) is undefined if we are at the top aggregator URL // is there a better way to do this? - if (!arg(1)) { + if (arg(1, '') === FALSE) { $form['feed_icon'] = array('#value' => theme('feed_icon', url('aggregator/rss'))); } - elseif (arg(1) == 'categories' && arg(2) && !arg(3)) { + elseif (arg(1, 'categories') && arg(2) && arg(3, '') === FALSE) { $form['feed_icon'] = array('#value' => theme('feed_icon', url('aggregator/rss/' . arg(2)))); } $output .= $form['feed_icon']['#value']; === modified file 'modules/archive.module' --- modules/archive.module +++ modules/archive.module @@ -72,7 +72,7 @@ function archive_calendar() { $end_of_today = mktime(23, 59, 59, date('n', time()), date('d', time()), date('Y', time())) + $user->timezone; // Extract the requested date: - if (arg(0) == 'archive' && arg(3)) { + if (arg(0, 'archive') && arg(3)) { $year = arg(1); $month = arg(2); $day = arg(3); === modified file 'modules/block.module' --- modules/block.module +++ modules/block.module @@ -194,8 +194,8 @@ function block_admin_display() { global $theme_key, $custom_theme; // If non-default theme configuration has been selected, set the custom theme. - if (arg(3)) { - $custom_theme = arg(3); + if (arg(3, '') === FALSE) { + $custom_theme = arg(3, DANGEROUS_ARG_RETRIEVE); // this is checked in init_theme } else { $custom_theme = variable_get('theme_default', 'bluemarine'); @@ -210,7 +210,7 @@ function block_admin_display() { $block_regions = system_region_list($theme_key); // Build form tree - $form['#action'] = arg(3) ? url('admin/block/list/' . $theme_key) : url('admin/block'); + $form['#action'] = (arg(3, '') === FALSE) ? url('admin/block/list/' . $theme_key) : url('admin/block'); $form['#tree'] = TRUE; foreach ($blocks as $i => $block) { $form[$i]['module'] = array('#type' => 'value', '#value' => $block['module']); === modified file 'modules/blog.module' --- modules/blog.module +++ modules/blog.module @@ -248,7 +248,7 @@ function blog_link($type, $node = 0, $ma $links = array(); if ($type == 'node' && $node->type == 'blog') { - if (arg(0) != 'blog' || arg(1) != $node->uid) { + if (arg(0, 'blog') || arg(1) != $node->uid) { $links[] = l(t("%username's blog", array('%username' => $node->name)), "blog/$node->uid", array('title' => t("Read %username's latest blog entries.", array('%username' => $node->name)))); } } === modified file 'modules/blogapi.module' --- modules/blogapi.module +++ modules/blogapi.module @@ -590,7 +590,7 @@ function blogapi_menu($may_cache) { } function blogapi_blogapi() { - switch (arg(1)) { + switch (arg(1, '') === FALSE) { case 'rsd': blogapi_rsd(); break; === modified file 'modules/book.module' --- modules/book.module +++ modules/book.module @@ -114,7 +114,7 @@ function book_menu($may_cache) { else { // To avoid SQL overhead, check whether we are on a node page and whether the // user is allowed to outline posts in books. - if (arg(0) == 'node' && is_numeric(arg(1)) && user_access('outline posts in books')) { + if (arg(0, 'node') && arg(1) && user_access('outline posts in books')) { // Only add the outline-tab for non-book pages: $result = db_query(db_rewrite_sql("SELECT n.nid FROM {node} n WHERE n.nid = %d AND n.type != 'book'"), arg(1)); if (db_num_rows($result) > 0) { @@ -147,7 +147,7 @@ function book_block($op = 'list', $delta } else if ($op == 'view') { // Only display this block when the user is browsing a book: - if (arg(0) == 'node' && is_numeric(arg(1))) { + if (arg(0, 'node') && arg(1)) { $result = db_query(db_rewrite_sql('SELECT n.nid, n.title, b.parent FROM {node} n INNER JOIN {book} b ON n.vid = b.vid WHERE n.nid = %d'), arg(1)); if (db_num_rows($result) > 0) { $node = db_fetch_object($result); @@ -177,7 +177,7 @@ function book_load($node) { $book = db_fetch_object(db_query('SELECT * FROM {book} WHERE vid = %d', $node->vid)); - if (arg(2) == 'edit' && !user_access('administer nodes')) { + if (arg(2, 'edit') && !user_access('administer nodes')) { // If a user is about to update a book page, we overload some // fields to reflect the changes. if ($user->uid) { @@ -964,7 +964,7 @@ function book_admin_edit_submit($form_id } } - if (is_numeric(arg(3))) { + if (arg(3)) { // Updating pages in a single book. $book = node_load(arg(3)); drupal_set_message(t('Updated book %title.', array('%title' => theme('placeholder', $book->title)))); @@ -1031,7 +1031,7 @@ function book_help($section) { return t("A book is a collaborative writing effort: users can collaborate writing the pages of the book, positioning the pages in the right order, and reviewing or modifying pages previously written. So when you have some information to share or when you read a page of the book and you didn't like it, or if you think a certain page could have been written better, you can do something about it."); } - if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'outline') { + if (arg(0, 'node') && arg(1) && arg(2, 'outline')) { return t('The outline feature allows you to include posts in the book hierarchy.', array('%book' => url('book'))); } } === modified file 'modules/comment.module' --- modules/comment.module +++ modules/comment.module @@ -129,14 +129,14 @@ function comment_menu($may_cache) { 'callback' => 'comment_edit', 'access' => $access, 'type' => MENU_CALLBACK); } else { - if (arg(0) == 'comment' && arg(1) == 'reply' && is_numeric(arg(2))) { + if (arg(0, 'comment') && arg(1, 'reply') && arg(2)) { $node = node_load(arg(2)); if ($node->nid) { $items[] = array('path' => 'comment/reply', 'title' => t('reply to comment'), 'callback' => 'comment_reply', 'access' => node_access('view', $node), 'type' => MENU_CALLBACK); } } - if ((arg(0) == 'node') && is_numeric(arg(1)) && is_numeric(arg(2))) { + if (arg(0, 'node') && arg(1) && arg(2)) { $items[] = array('path' => ('node/'. arg(1) .'/'. arg(2)), 'title' => t('view'), 'callback' => 'node_page', 'type' => MENU_CALLBACK); @@ -450,7 +450,11 @@ function comment_access($op, $comment) { } function comment_node_url() { - return arg(0) .'/'. arg(1); + $arg0 = arg(0, DANGEROUS_ARG_RETRIEVE); + if ($arg0 != 'node') { + $arg0 = 'comment'; + } + return $arg0 .'/'. arg(1); } function comment_edit($cid) { @@ -952,7 +956,7 @@ function comment_admin_overview($type = '#prefix' => '
', '#suffix' => '
' ); $options = array(); - foreach (comment_operations(arg(3) == 'approval' ? 'publish' : 'unpublish') as $key => $value) { + foreach (comment_operations(arg(3, 'approval') ? 'publish' : 'unpublish') as $key => $value) { $options[$key] = $value[0]; } $form['options']['operation'] = array('#type' => 'select', '#options' => $options, '#default_value' => 'publish'); === modified file 'modules/contact.module' --- modules/contact.module +++ modules/contact.module @@ -100,7 +100,7 @@ function contact_menu($may_cache) { ); } else { - if (arg(0) == 'user' && is_numeric(arg(1))) { + if (arg(0, 'user') && arg(1)) { global $user; $items[] = array('path' => 'user/'. arg(1) .'/contact', 'title' => t('contact'), @@ -157,7 +157,7 @@ function contact_admin_categories() { * Category edit page. */ function contact_admin_edit($cid = NULL) { - if (arg(3) == "edit" && $cid > 0) { + if (arg(3, 'edit') && $cid > 0) { $edit = db_fetch_array(db_query("SELECT * FROM {contact} WHERE cid = %d", $cid)); } $form['category'] = array('#type' => 'textfield', @@ -233,7 +233,7 @@ function contact_admin_edit_submit($form $recipients[$key] = trim($recipient); } $form_values['recipients'] = implode(',', $recipients); - if (arg(3) == 'add') { + if (arg(3, 'add')) { db_query("INSERT INTO {contact} (category, recipients, reply, weight, selected) VALUES ('%s', '%s', '%s', %d, %d)", $form_values['category'], $form_values['recipients'], $form_values['reply'], $form_values['weight'], $form_values['selected']); drupal_set_message(t('Category %category has been added.', array('%category' => theme('placeholder', $form_values['category'])))); watchdog('mail', t('Contact form: category %category added.', array('%category' => theme('placeholder', $form_values['category']))), WATCHDOG_NOTICE, l(t('view'), 'admin/contact')); === modified file 'modules/filter.module' --- modules/filter.module +++ modules/filter.module @@ -95,7 +95,7 @@ function filter_menu($may_cache) { ); } else { - if (arg(0) == 'admin' && arg(1) == 'filters' && is_numeric(arg(2))) { + if (arg(0, 'admin') && arg(1, 'filters') && arg(2)) { $formats = filter_formats(); if (isset($formats[arg(2)])) { === modified file 'modules/forum.module' --- modules/forum.module +++ modules/forum.module @@ -81,7 +81,7 @@ function forum_menu($may_cache) { 'access' => user_access('administer forums'), 'type' => MENU_LOCAL_TASK); } - elseif (is_numeric(arg(4))) { + elseif (arg(4)) { $term = taxonomy_get_term(arg(4)); // Check if this is a valid term. if ($term) { === modified file 'modules/help.module' --- modules/help.module +++ modules/help.module @@ -120,8 +120,8 @@ function help_help($section) { * Menu callback; prints a page listing general help for all modules. */ function help_page() { - $name = arg(2); $output = ''; + $name = arg(2, DANGEROUS_ARG_RETRIEVE); // this is checked in the following if if (module_hook($name, 'help')) { $temp = module_invoke($name, 'help', "admin/help#$name"); if (empty($temp)) { === modified file 'modules/locale.module' --- modules/locale.module +++ modules/locale.module @@ -111,7 +111,7 @@ function locale_menu($may_cache) { 'type' => MENU_CALLBACK); } else { - if (is_numeric(arg(4))) { + if (arg(4)) { // String related callbacks $items[] = array('path' => 'admin/locale/string/edit/'. arg(4), 'title' => t('edit string'), @@ -318,7 +318,7 @@ function locale_admin_manage() { */ function locale_admin_manage_delete_form() { include_once './includes/locale.inc'; - $langcode = arg(4); + $langcode = arg(4, DANGEROUS_ARG_RETRIEVE); // this is checked against locale_supported_languages() // Do not allow deletion of English locale. if ($langcode == 'en') { === modified file 'modules/menu.module' --- modules/menu.module +++ modules/menu.module @@ -303,7 +303,7 @@ function menu_configure() { * Menu callback; handle the adding/editing of a new menu. */ function menu_edit_menu_form($mid = 0) { - if (arg(3) == 'edit') { + if (arg(3, 'edit')) { if (!($item = db_fetch_array(db_query('SELECT * FROM {menu} WHERE mid = %d', $mid)))) { drupal_not_found(); return; @@ -333,7 +333,7 @@ function menu_edit_menu_form($mid = 0) { * Present the menu item editing form. */ function menu_edit_item_form($mid = 0) { - if (arg(3) == 'edit') { + if (arg(3, 'edit')) { if (!($item = db_fetch_array(db_query('SELECT * FROM {menu} WHERE mid = %d', $mid)))) { drupal_not_found(); return; === modified file 'modules/node.module' --- modules/node.module +++ modules/node.module @@ -43,12 +43,12 @@ function node_help($section) { return t('

Enter a simple pattern to search for a post. This can include the wildcard character *.
For example, a search for "br*" might return "bread bakers", "our daily bread" and "brenda".

'); } - if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'revisions') { + if (arg(0, 'node') && arg(1) && arg(2, 'revisions')) { return t('The revisions let you track differences between multiple versions of a post.'); } - if (arg(0) == 'node' && arg(1) == 'add' && $type = arg(2)) { - return filter_xss_admin(variable_get($type .'_help', '')); + if (arg(0, 'node') && arg(1, 'add') && $type = arg(2, DANGEROUS_ARG_RETRIEVE)) { + return filter_xss_admin(variable_get($type .'_help', '')); // $type .'_help' is an array index, so it's safe } } @@ -859,7 +859,7 @@ function node_menu($may_cache) { 'type' => MENU_CALLBACK); } else { - if (arg(0) == 'node' && is_numeric(arg(1))) { + if (arg(0, 'node') && arg(1)) { $node = node_load(arg(1)); if ($node->nid) { $items[] = array('path' => 'node/'. arg(1), 'title' => t('view'), @@ -886,10 +886,13 @@ function node_menu($may_cache) { 'type' => MENU_LOCAL_TASK); } } - else if (arg(0) == 'admin' && arg(1) == 'settings' && arg(2) == 'content-types' && is_string(arg(3))) { - $items[] = array('path' => 'admin/settings/content-types/'. arg(3), - 'title' => t("'%name' content type", array('%name' => node_get_name(arg(3)))), - 'type' => MENU_CALLBACK); + else if (arg(0, 'admin') && arg(1, 'settings') && arg(2, 'content-types')) { + $arg3 = arg(3, DANGEROUS_ARG_RETRIEVE); // this will be used as an array index, so it's safe + if ($node_name = node_get_name($arg3)) { + $items[] = array('path' => 'admin/settings/content-types/'. $arg3, + 'title' => t("'%name' content type", array('%name' => $node_name)), + 'type' => MENU_CALLBACK); + } } } @@ -1901,8 +1904,8 @@ function node_delete($nid) { * Menu callback for revisions related activities. */ function node_revisions() { - if (is_numeric(arg(1)) && arg(2) == 'revisions') { - $op = arg(4) ? arg(4) : 'overview'; + if (arg(1) && arg(2, 'revisions')) { + $op = arg(4, DANGEROUS_ARG_RETRIEVE) ? arg(4, DANGEROUS_ARG_RETRIEVE) : 'overview'; // this is used only for the following switch switch ($op) { case 'overview': $node = node_load(arg(1)); @@ -1912,7 +1915,7 @@ function node_revisions() { drupal_access_denied(); return; case 'view': - if (is_numeric(arg(3))) { + if (arg(3)) { $node = node_load(arg(1), arg(3)); if ($node->nid) { if ((user_access('view revisions') || user_access('administer nodes')) && node_access('view', $node)) { @@ -1992,15 +1995,18 @@ function node_page_default() { * Menu callback; dispatches control to the appropriate operation handler. */ function node_page() { - $op = arg(1); + $op = arg(1, DANGEROUS_ARG_RETRIEVE); // this will be used only for an if and and switch in this function alone - if (is_numeric($op)) { - $op = (arg(2) && !is_numeric(arg(2))) ? arg(2) : 'view'; + if (!$op) { + $op = arg(2, DANGEROUS_ARG_RETRIEVE); // this will be used only for the following switch + if (is_numeric($op)) { + $op = 'view'; + } } switch ($op) { case 'view': - if (is_numeric(arg(1))) { + if (arg(1)) { $node = node_load(arg(1)); if ($node->nid) { drupal_set_title(check_plain($node->title)); @@ -2015,7 +2021,7 @@ function node_page() { } break; case 'add': - return node_add(arg(2)); + return node_add(arg(2, DANGEROUS_ARG_RETRIEVE)); // node_add checks this against node_get_types break; case 'edit': if ($_POST['op'] == t('Delete')) { @@ -2027,7 +2033,7 @@ function node_page() { drupal_goto('node/'. arg(1) .'/delete', $destination); } - if (is_numeric(arg(1))) { + if (arg(1)) { $node = node_load(arg(1)); if ($node->nid) { drupal_set_title(check_plain($node->title)); @@ -2126,7 +2132,7 @@ function node_form_alter($form_id, &$for } // Advanced node search form - elseif ($form_id == 'search_form' && arg(1) == 'node' && user_access('use advanced search')) { + elseif ($form_id == 'search_form' && arg(1, 'node') && user_access('use advanced search')) { // Keyword boxes: $form['advanced'] = array( '#type' => 'fieldset', === modified file 'modules/poll.module' --- modules/poll.module +++ modules/poll.module @@ -203,7 +203,7 @@ function poll_menu($may_cache) { 'type' => MENU_CALLBACK); } else { - if (arg(0) == 'node' && is_numeric(arg(1))) { + if (arg(0, 'node') && arg(1)) { $node = node_load(arg(1)); if ($node->type == 'poll' && $node->allowvotes) { @@ -463,7 +463,7 @@ function poll_view(&$node, $teaser = FAL $node->links = $links; } - if ($node->allowvotes && ($block || arg(2) != 'results')) { + if ($node->allowvotes && ($block || !arg(2, 'results'))) { $output .= poll_view_voting($node, $teaser, $page, $block); } else { === modified file 'modules/profile.module' --- modules/profile.module +++ modules/profile.module @@ -119,7 +119,7 @@ function profile_block($op = 'list', $de } else if ($op == 'view') { if (user_access('access user profiles')) { - if ((arg(0) == 'node') && is_numeric(arg(1)) && (arg(2) == NULL)) { + if (arg(0, 'node') && arg(1) && arg(2, '')) { $node = node_load(arg(1)); $account = user_load(array('uid' => $node->uid)); @@ -183,7 +183,7 @@ function profile_user($type, &$edit, &$u * Menu callback: Generate a form to add/edit a user profile field. */ function profile_field_form($arg = NULL) { - if (arg(3) == 'edit') { + if (arg(3, 'edit')) { if (is_numeric($arg)) { $fid = $arg; @@ -515,7 +515,7 @@ function profile_load_profile(&$user) { } function profile_save_profile(&$edit, &$user, $category) { - if ((arg(0) == 'user' && arg(1) == 'register') || (arg(0) == 'admin' && arg(1) == 'user' && arg(2) == 'create')) { + if ((arg(0, 'user') && arg(1, 'register')) || (arg(0, 'admin') && arg(1, 'user') && arg(2, 'create'))) { $result = db_query('SELECT fid, name, type FROM {profile_fields} WHERE register = 1 AND visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); } else { @@ -619,10 +619,10 @@ function _profile_form_explanation($fiel } function profile_form_profile($edit, $user, $category) { - if (arg(0) == 'user' && arg(1) == 'register') { + if (arg(0, 'user') && arg(1, 'register')) { $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND register = 1 ORDER BY category, weight', PROFILE_HIDDEN); } - elseif (arg(0) == 'admin' && arg(1) == 'user' && arg(2) == 'create') { + elseif (arg(0, 'admin') && arg(1, 'user') && arg(2, 'create')) { $result = db_query('SELECT * FROM {profile_fields} WHERE register = 1 ORDER BY category, weight'); } elseif (user_access('administer users')) { @@ -732,10 +732,10 @@ function _profile_update_user_fields($fi } function profile_validate_profile($edit, $category) { - if (arg(0) == 'user' && arg(1) == 'register') { + if (arg(0, 'user') && arg(1, 'register')) { $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND register = 1 ORDER BY category, weight', PROFILE_HIDDEN); } - elseif (arg(0) == 'admin' && arg(1) == 'user' && arg(2) == 'create') { + elseif (arg(0, 'admin') && arg(1, 'user') && arg(2, 'create')) { $result = db_query('SELECT * FROM {profile_fields} WHERE register = 1 ORDER BY category, weight'); } elseif (user_access('administer users')) { === modified file 'modules/search.module' --- modules/search.module +++ modules/search.module @@ -160,7 +160,7 @@ function search_menu($may_cache) { 'access' => user_access('administer search'), 'type' => MENU_CALLBACK); } - else if (arg(0) == 'search') { + else if (arg(0, 'search')) { // To remember the user's search keywords when switching across tabs, // we dynamically add the keywords to the search tabs' paths. $keys = search_get_keys(); === modified file 'modules/statistics.module' --- modules/statistics.module +++ modules/statistics.module @@ -66,7 +66,7 @@ function statistics_exit() { if (variable_get('statistics_count_content_views', 0)) { // We are counting content views. - if ((arg(0) == 'node') && is_numeric(arg(1)) && arg(2) == '') { + if (arg(0, 'node') && arg(1) && arg(2, '')) { // A node has been viewed, so update the node's counters. db_query('UPDATE {node_counter} SET daycount = daycount + 1, totalcount = totalcount + 1, timestamp = %d WHERE nid = %d', time(), arg(1)); // If we affected 0 rows, this is the first time viewing the node. @@ -130,12 +130,12 @@ function statistics_menu($may_cache) { 'type' => MENU_CALLBACK); } else { - if (arg(0) == 'user' && is_numeric(arg(1)) && variable_get('statistics_enable_access_log', 0)) { + if (arg(0, 'user') && arg(1) && variable_get('statistics_enable_access_log', 0)) { $items[] = array('path' => 'user/'. arg(1) .'/track/navigation', 'title' => t('track page visits'), 'callback' => 'statistics_user_tracker', 'access' => $access, 'type' => MENU_LOCAL_TASK, 'weight' => 2); } - if (arg(0) == 'node' && is_numeric(arg(1)) && variable_get('statistics_enable_access_log', 0)) { + if (arg(0, 'node') && arg(1) && variable_get('statistics_enable_access_log', 0)) { $items[] = array('path' => 'node/'. arg(1) .'/track', 'title' => t('track'), 'callback' => 'statistics_node_tracker', 'access' => $access, 'type' => MENU_LOCAL_TASK, 'weight' => 2); === modified file 'modules/system.module' --- modules/system.module +++ modules/system.module @@ -36,8 +36,8 @@ function system_help($section) { return t('

Select which themes are available to your users and specify the default theme. To configure site-wide display settings, click the "configure" task above. Alternately, to override these settings in a specific theme, click the "configure" link for the corresponding theme. Note that different themes may have different regions available for rendering content like blocks. If you want consistency in what your users see, you may wish to enable only one theme.

'); case 'admin/themes/settings': return t('

These options control the default display settings for your entire site, across all themes. Unless they have been overridden by a specific theme, these settings will be used.

'); - case 'admin/themes/settings/'. arg(3): - $reference = explode('.', arg(3), 2); + case 'admin/themes/settings/'. arg(3, DANGEROUS_ARG_RETRIEVE): + $reference = explode('.', check_plain(arg(3, DANGEROUS_ARG_RETRIEVE)), 2); $theme = array_pop($reference); return t('

These options control the display settings for the %template theme. When your site is displayed using this theme, these settings will be used. By clicking "Reset to defaults," you can choose to use the global settings for this theme.

', array('%template' => $theme, '%global' => url('admin/themes/settings'))); case 'admin/modules': === modified file 'modules/taxonomy.module' --- modules/taxonomy.module +++ modules/taxonomy.module @@ -92,7 +92,7 @@ function taxonomy_menu($may_cache) { 'type' => MENU_CALLBACK); } else { - if (is_numeric(arg(2))) { + if (arg(2)) { $items[] = array('path' => 'admin/taxonomy/' . arg(2), 'title' => t('list terms'), 'callback' => 'taxonomy_overview_terms', === modified file 'modules/tracker.module' --- modules/tracker.module +++ modules/tracker.module @@ -48,7 +48,7 @@ function tracker_menu($may_cache) { } } else { - if (arg(0) == 'user' && is_numeric(arg(1))) { + if (arg(0, 'user') && arg(1)) { $items[] = array('path' => 'user/'. arg(1) .'/track', 'title' => t('track'), 'callback' => 'tracker_track_user', 'access' => user_access('access content'), 'type' => MENU_IS_LOCAL_TASK); === modified file 'modules/user.module' --- modules/user.module +++ modules/user.module @@ -530,7 +530,7 @@ function user_block($op = 'list', $delta switch ($delta) { case 0: // For usability's sake, avoid showing two login forms on one page. - if (!$user->uid && !(arg(0) == 'user' && !is_numeric(arg(1)))) { + if (!$user->uid && !(arg(0, 'user') && !arg(1))) { $form['#action'] = url($_GET['q'], drupal_get_destination()); $form['#id'] = 'user-login-form'; $form['name'] = array('#type' => 'textfield', @@ -777,7 +777,7 @@ function user_menu($may_cache) { 'weight' => 10); } else { - if (arg(0) == 'user' && is_numeric(arg(1)) && arg(1) > 0) { + if (arg(0, 'user') && arg(1) > 0) { $account = user_load(array('uid' => arg(1))); if ($user !== FALSE) { @@ -800,7 +800,7 @@ function user_menu($may_cache) { 'callback' => 'user_edit', 'access' => $admin_access, 'type' => MENU_CALLBACK); - if (arg(2) == 'edit') { + if (arg(2, 'edit')) { if (($categories = _user_categories()) && (count($categories) > 1)) { foreach ($categories as $key => $category) { $items[] = array( @@ -1331,7 +1331,7 @@ function user_edit_form($uid, $edit) { function _user_edit_validate($uid, &$edit) { $user = user_load(array('uid' => $uid)); // Validate the username: - if (user_access('change own username') || user_access('administer users') || arg(1) == 'register') { + if (user_access('change own username') || user_access('administer users') || arg(1, 'register')) { if ($error = user_validate_name($edit['name'])) { form_set_error('name', $error); } @@ -1380,7 +1380,7 @@ function user_edit($category = 'account' $account = user_load(array('uid' => arg(1))); $edit = $_POST['op'] ? $_POST['edit'] : (array)$account; - if (arg(2) == 'delete') { + if (arg(2, 'delete')) { if ($edit['confirm']) { db_query('DELETE FROM {users} WHERE uid = %d', $account->uid); db_query('DELETE FROM {sessions} WHERE uid = %d', $account->uid); @@ -1970,7 +1970,7 @@ function user_admin() { $op = isset($_POST['op']) ? $_POST['op'] : ''; if (empty($op)) { - $op = arg(2); + $op = arg(2, DANGEROUS_ARG_RETRIEVE); // this will only be used for the following switch } switch ($op) {