From 598ec4fedb1cce4090aecabb0a00e56a81b2e2f8 Mon, 6 Jun 2011 16:02:39 +0200
From: Bram Goffings <bramgoffings@gmail.com>
Date: Mon, 6 Jun 2011 16:02:09 +0200
Subject: [PATCH] Fixing color module


diff --git a/modules/color/color.module b/modules/color/color.module
index ff6c70e..f3fafe7 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -42,6 +42,7 @@
       '#theme' => 'color_scheme_form',
     );
     $form['color'] += color_scheme_form($form, $form_state, $theme);
+    $form['#validate'][] = 'color_scheme_form_validate';
     $form['#submit'][] = 'color_scheme_form_submit';
   }
 }
@@ -269,6 +270,18 @@
 
   return $output;
 }
+
+/**
+ * Validation handler for color change form.
+ */
+function color_scheme_form_validate($form, &$form_state) {
+  // Only accept hexadecimal CSS color strings to avoid XSS upon use.
+  foreach ($form_state['values']['palette'] as $key => $color) {
+    if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+      form_set_error('palette][' . $key, t('%name must be a valid hexadecimal CSS color value.', array('%name' => $form['color']['palette'][$key]['#title'])));
+    }
+  }
+}
 
 /**
  * Submit handler for color change form.
diff --git a/modules/color/color.test b/modules/color/color.test
index 1ddfc06..efb5cd5 100644
--- a/modules/color/color.test
+++ b/modules/color/color.test
@@ -93,4 +93,22 @@
     $this->assertTrue(strpos($stylesheet_content, 'public://') === FALSE, 'Make sure the color paths have been translated to local paths. (' . $theme . ')');
     variable_set('preprocess_css', 0);
   }
+
+  /**
+   * Test to see if the provided color is valid
+   */
+  function testValidColor() {
+    variable_set('theme_default', 'bartik');
+    $settings_path = 'admin/appearance/settings/bartik';
+
+    $edit['scheme'] = '';
+
+    $edit['palette[bg]'] = '#abcdefg';
+    $this->drupalPost($settings_path, $edit, t('Save configuration'));
+    $this->assertText('%name must be a valid hexadecimal CSS color value');
+
+    $edit['palette[bg]'] = '#z012345';
+    $this->drupalPost($settings_path, $edit, t('Save configuration'));
+    $this->assertText('%name must be a valid hexadecimal CSS color value');
+  }
 }