Download & Extend
Node Relativity » Issues

function t() is being used to translate user submitted text

Posted by unknownguy on August 27, 2008 at 11:30pm
Project:Node Relativity
Version:6.x-1.x-dev
Component:Code
Category:bug report
Priority:normal
Assigned:Unassigned
Status:closed (fixed)

Issue Summary

Hello,

I have detected that some user submitted strings where being inserted into locales_source table.

Upon investigation I have found (using debug_backtrace() in the function locale), I have found that this module is the culprit. Look at the following lines:

...
1491             $children_box .= l(t($child_node->title), 'node/'.$child_node->nid, array('class' => 'relativity_view_' . $childtype)) . "<br />\n";
...
1639   $output .= node_get_types('name',$ancestor->type) . ': ' . l(t($ancestor->title), 'node/'.$ancestor->        nid, array('class' => 'relativity_view_' . $type));

(maybe there are more places in the .module...)

Is this a bug? I guess it is.

Login or register to post comments

Comments

#1

Posted by unknownguy on August 28, 2008 at 7:44am
Title:function t() is being using to translate user submitted text» function t() is being used to translate user submitted text

#2

Posted by janusman on March 25, 2009 at 12:11am
Status:active» needs review

Patch included

AttachmentSize
relativity-300834.patch 1.23 KB

#3

Posted by janusman on March 25, 2009 at 12:17am
Version:5.x-2.1» 5.x-2.3

Sorry, missed one t().. and this is for 5.x-2.3

AttachmentSize
relativity-300834-2.patch 2.09 KB

#4

Posted by dereine on August 19, 2009 at 3:54pm
Status:needs review» reviewed & tested by the community

Patch works fine on DRUPAL5 version.

Here is a patch which applies clean to drupal5.

Set to "rtbc" for DRUPAL-5 Version.

AttachmentSize
relativity-300834-drupal6.patch 2.17 KB

#5

Posted by tacituseu on August 20, 2009 at 7:05pm
Status:reviewed & tested by the community» needs work

You meant D6 ? it's already fixed in D5. And it should use check_plain().

#6

Posted by jonhattan on July 1, 2011 at 9:48am
Version:5.x-2.3» 6.x-1.x-dev
Status:needs work» fixed

Committed a fix.

#7

Posted by System Message on July 15, 2011 at 9:51am
Status:fixed» closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

nobody click here