From 03b96399d99373261e85a51d73fd9146effa1695 Mon, 6 Jun 2011 11:31:49 +0200
From: Bram Goffings <bramgoffings@gmail.com>
Date: Mon, 6 Jun 2011 11:29:24 +0200
Subject: [PATCH] color module security fix


diff --git a/modules/color/color.module b/modules/color/color.module
index ff6c70e..f3fafe7 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -42,6 +42,7 @@
       '#theme' => 'color_scheme_form',
     );
     $form['color'] += color_scheme_form($form, $form_state, $theme);
+    $form['#validate'][] = 'color_scheme_form_validate';
     $form['#submit'][] = 'color_scheme_form_submit';
   }
 }
@@ -269,6 +270,18 @@
 
   return $output;
 }
+
+/**
+ * Validation handler for color change form.
+ */
+function color_scheme_form_validate($form, &$form_state) {
+  // Only accept hexadecimal CSS color strings to avoid XSS upon use.
+  foreach ($form_state['values']['palette'] as $key => $color) {
+    if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+      form_set_error('palette][' . $key, t('%name must be a valid hexadecimal CSS color value.', array('%name' => $form['color']['palette'][$key]['#title'])));
+    }
+  }
+}
 
 /**
  * Submit handler for color change form.