By promes on

By chance I opened the SA-CORE-2009-005-5.16.patch and found out we also had to update all themes we changed and/or created ourselves. Both for Drupal 5 and Drupal 6!
Be warned !!

⋅ Categories: Drupal 5.x, Drupal 6.x

Comments

Bobby1290’s picture

Bobby1290 commented

This only applies if you are NOT patching and NOT doing an Upgrade as it says in the SA-CORE-2009-005 announcement.
The upgrade will inject the needed string in all your themes. leaving them like:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
  <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>BobbyMods.com | Project Ultra Light</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="alternate" type="application/rss+xml" title="BobbyMods.com RSS"

Leaving you with two "Content Type" =utf-8 rows, which is ugly, but better than nothing.

This item in the SA-CORE-2009-005-6.10 patch does the insert:

RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.756.2.48
diff -u -p -r1.756.2.48 common.inc
--- includes/common.inc	25 Feb 2009 23:16:45 -0000	1.756.2.48
+++ includes/common.inc	29 Apr 2009 23:02:31 -0000
@@ -152,6 +152,15 @@ function drupal_get_headers() {
 }
 
 /**
+ * Make any final alterations to the rendered xhtml.
+ */
+function drupal_final_markup($content) {
+  // Make sure that the charset is always specified as the first element of the
+  // head region to prevent encoding-based attacks.
+  return preg_replace('/<head[^>]*>/i', "\$0\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />", $content, 1);
+}
+
+/**
  * Add a feed URL for the current page.
  *
  * @param $url
Index: includes/theme.inc

However, as always, you should check for changes in themes or modules (or any other duplicates and derivatives of core) before you upgrade so you know what is going on.

I posted on this at http://www.bobbymods.com/updated-drupal-611.