Index: includes/bootstrap.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v retrieving revision 1.145.2.13 diff -u -p -r1.145.2.13 bootstrap.inc --- includes/bootstrap.inc 14 Jan 2009 19:12:27 -0000 1.145.2.13 +++ includes/bootstrap.inc 30 Apr 2009 00:29:00 -0000 @@ -725,6 +725,8 @@ function request_uri() { $uri = $_SERVER['SCRIPT_NAME'] .'?'. $_SERVER['QUERY_STRING']; } } + // Prevent multiple slashes to avoid cross site requests via the FAPI. + $uri = '/'. ltrim($uri, '/'); return $uri; } Index: includes/common.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/common.inc,v retrieving revision 1.611.2.22 diff -u -p -r1.611.2.22 common.inc --- includes/common.inc 16 Jan 2009 19:26:09 -0000 1.611.2.22 +++ includes/common.inc 30 Apr 2009 00:29:00 -0000 @@ -152,6 +152,15 @@ function drupal_get_headers() { } /** + * Make any final alterations to the rendered xhtml. + */ +function drupal_final_markup($content) { + // Make sure that the charset is always specified as the first element of the + // head region to prevent encoding-based attacks. + return preg_replace('/
]*>/i', "\$0\n", $content, 1); +} + +/** * Add a feed URL for the current page. * * @param $url Index: includes/theme.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/theme.inc,v retrieving revision 1.337.2.7 diff -u -p -r1.337.2.7 theme.inc --- includes/theme.inc 5 Dec 2008 22:32:50 -0000 1.337.2.7 +++ includes/theme.inc 30 Apr 2009 00:29:00 -0000 @@ -168,7 +168,12 @@ function theme() { $functions[$function] = theme_get_function($function); } if ($functions[$function]) { - return call_user_func_array($functions[$function], $args); + $output = call_user_func_array($functions[$function], $args); + // Add final markup to the full page. + if ($function == 'page') { + $output = drupal_final_markup($output); + } + return $output; } } Index: themes/bluemarine/page.tpl.php =================================================================== RCS file: /cvs/drupal/drupal/themes/bluemarine/Attic/page.tpl.php,v retrieving revision 1.20 diff -u -p -r1.20 page.tpl.php --- themes/bluemarine/page.tpl.php 30 Aug 2006 07:37:13 -0000 1.20 +++ themes/bluemarine/page.tpl.php 30 Apr 2009 00:29:00 -0000 @@ -2,8 +2,8 @@ -