$format not handled correctly in node preview

I can confirm this, attached is a patch which fixes this.

Fixed in CVS! Thanks!

Please release?

+  $node->format = isset($_POST['format']) ? $_POST['format'] : 1;
+  $node->body = check_markup($body, $node->format);
   $node->name = isset($_POST['username']) ? $_POST['username'] : '';
   $node->created = isset($_POST['date']) ? strtotime($_POST['date']) : time();
 
   $access = user_access('use live comment preview');
   $token = $_POST['token'] != "" ? $_POST['token'] : "";
   $skip_anonymous = $user->uid == 0 ? true : false;
-  $format = isset($_POST['format']) ? $_POST['format'] : 1;
   $token_value = isset($_POST['token_value']) ? $_POST['token_value'] : '';
   $valid_token = drupal_valid_token($token, $token_value, $skip_anonymous);
 
-  if (!filter_access($format) || !$access || !$valid_token || !node_access('create', $node) || !node_access('update', $node)) {
+  if (!filter_access($node->format) || !$access || !$valid_token || !node_access('create', $node) || !node_access('update', $node)) {

POOF.

The filter_access check has to be BEFORE using the Input format. With the patch users can run arbitrary formats. What if the PHP filter is enabled for one of those?

Note, while fortunately check_markup does an access check as well (third arg TRUE), arbitrary code execution via CSRF is still possible because check_markup is used before the token check.

Fixed with 6.x-1.1

Well, 6.x-1.2