962   $logs = "Order: <pre>" . print_r($order, true) . "</pre>";
 963   $logs .= "Payment Method: <pre>" . print_r($payment_method, true) . "</pre>";
 964   $logs .= "IPN: <pre>" . print_r($ipn, true) . "</pre>";
 965   watchdog("commerce_subscription IPN Process", $logs);
 966

These require a check_plain. eg

$logs = "Order: <pre>" . check_plain(print_r($order, true)) . "</pre>";
// uzw.

I've not confirmed that this is exploitable.

CommentFileSizeAuthor
#2 commerce-subscription-filter-xss-1570502-2.patch947 bytesduaelfr

Comments

instanceofjamie’s picture

instanceofjamie commented

Agreed. Again, if I get a patch in the next week or so I'll apply it, if not I'll grab some time to make the change myself.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
StatusFileSize
new commerce-subscription-filter-xss-1570502-2.patch947 bytes

Here is a patch using the filter_xss function from drupal core.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Status: Active » Needs review