When a node using the "PHP code" input filter is included in an RSS feed, any PHP code in that node is not evaluated. This means that instead of the feed including the results of the PHP code, it instead includes the unevaluated PHP code in the description.

CommentFileSizeAuthor
#5 feed_security_0.patch1.34 KBeaton
#4 feed_security.patch1.35 KBeaton

Comments

fgm’s picture

fgm
Primary language French
Location Paris, France
commented
Priority: Critical » Normal

What is the type of feed involved ? Is it /rss.xml ? A taxonomy feed ? Another type of feed ?

Downgrading to critical because it does not prevent the base system from being used.

webernet’s picture

webernet commented

Applies to both /rss.xml and taxonomy feeds (possibly others as well).

Originally marked as critical since it is a possible security concern because the bug causes PHP code to be displayed to users and/or the public.

webernet’s picture

webernet commented

Note: This is a regression - the PHP is evaluated as expected in 4.7.x

eaton’s picture

eaton commented
StatusFileSize
new feed_security.patch1.35 KB

There was a subtle change to node_prepare() in 5.0. After a full node_view() everything is handled properly, but some code (like feed generation) calls node_prepare without every completing a full node_view(). That leaves node->body in an unfiltered state. This corrects that loophole.

eaton’s picture

eaton commented
StatusFileSize
new feed_security_0.patch1.34 KB

Minor code-style cleanup.

chx’s picture

chx commented
Priority: Normal » Critical

Back to critical. This can lead to a sechole.

webernet’s picture

webernet commented
Status: Needs review » Reviewed & tested by the community

Patch fixes the original issue. RTBC

moshe weitzman’s picture

moshe weitzman commented

looks good to me

dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)