In 

function _webform_filter_values($string, $node = NULL, $submission = NULL, $strict = TRUE) {
...

  if ($strict) {
    return filter_xss($string);  
  }
  else {
    return $string;
  }
}

I'm getting an error, when the form is submitted, with a select (checkboxes) option.

warning: preg_match() expects parameter 2 to be string, array given in /includes/bootstrap.inc on line 670.

I inserted 

     if (is_array($string)){
     die("not string! " . print_r($string, true)); 
    }

into the above, And Yes, it's an array being passed, not a string. filter_xss calls drupal_validate_utf8 (in bootstrap.inc) which requires a string, not an array.
Will a simple change to ($strict AND !is_array($string)) work here, or is more needed, just in case of xss?

CommentFileSizeAuthor
#3 webform_filter_xss_fix.patch1.35 KBquicksketch

Comments

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Closed (fixed)

The problem had been that an array was being passed into the function to begin with (which should never happen). I believe this problem has been fixed as I haven't been able to reproduce it and there are no confirming reports. Please reopen if this problem exists in the latest version of Webform.

cswan’s picture

cswan commented
Version: 5.x-2.1.1 » 5.x-2.3
Status: Closed (fixed) » Active

Hi Nate, I was at Lullabot’s workshop at Arizona State University this fall. I work with Kathy.

I still received an error using the latest version 5.x-2.3 for Drupal 5, when the form is submitted, with a select (checkboxes) option:

warning: preg_match() expects parameter 2 to be string, array given in /includes/bootstrap.inc on line 670.

I needed the select option to be the email subject line. So, I inserted the following code at the same place where sethcohn inserted her code:

if (is_array($string)){
     //die("not string! " . print_r($string, true));
     $i = 0;
     $mystring = "";
     foreach( $string as $myarray ) {
          if($i == 0 ){
                $mystring = $myarray;
          }else {
                $mystring .= ", ". $myarray;
          }
         $i = $i + 1;
      }
      $string = $mystring;
 }

The form is functioning in the way I wanted. If there is better ways of doing it, please let me know.
Thank you very much.

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Fixed
StatusFileSize
new webform_filter_xss_fix.patch1.35 KB

Hi chizuko! Sorry for the delayed response, you caught me right before vacation. :)

Great to hear from some ASU peeps! I had a great time down there. Thanks to your description of the problem I went up one level and fixed the original call to _webform_filter_values(). It shouldn't ever be called with anything but a string, so I looped through the array and ran it separately for each value. The final solution is in the attached patch.

(btw, 39 weeks membership on drupal.org and this is the first post!? I welcome your help (or questions) any time!)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.

cswan’s picture

cswan commented

Hi Nate,
Thank you so much for your response.

I hope you are doing well.

I’m just double-checking with you. Are you going to incorporate your fix to the next version of Webform for Drupal 5 and 6?

Chizuko