From 16dca13a576e42fa9ffe6f736927daf7aa997cb4 Mon, 6 Jun 2011 18:38:23 +0200
From: Bram Goffings <bramgoffings@gmail.com>
Date: Mon, 6 Jun 2011 18:37:56 +0200
Subject: [PATCH] Fixing color module



diff --git a/modules/color/color.module b/modules/color/color.module
index ff6c70e..f3fafe7 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -42,6 +42,7 @@
       '#theme' => 'color_scheme_form',
     );
     $form['color'] += color_scheme_form($form, $form_state, $theme);
+    $form['#validate'][] = 'color_scheme_form_validate';
     $form['#submit'][] = 'color_scheme_form_submit';
   }
 }
@@ -269,6 +270,18 @@
 
   return $output;
 }
+
+/**
+ * Validation handler for color change form.
+ */
+function color_scheme_form_validate($form, &$form_state) {
+  // Only accept hexadecimal CSS color strings to avoid XSS upon use.
+  foreach ($form_state['values']['palette'] as $key => $color) {
+    if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+      form_set_error('palette][' . $key, t('%name must be a valid hexadecimal CSS color value.', array('%name' => $form['color']['palette'][$key]['#title'])));
+    }
+  }
+}
 
 /**
  * Submit handler for color change form.
diff --git a/modules/color/color.test b/modules/color/color.test
index 1ddfc06..953b10a 100644
--- a/modules/color/color.test
+++ b/modules/color/color.test
@@ -93,4 +93,22 @@
     $this->assertTrue(strpos($stylesheet_content, 'public://') === FALSE, 'Make sure the color paths have been translated to local paths. (' . $theme . ')');
     variable_set('preprocess_css', 0);
   }
+
+  /**
+   * Test to see if the provided color is valid
+   */
+  function testValidColor() {
+    variable_set('theme_default', 'bartik');
+    $settings_path = 'admin/appearance/settings/bartik';
+
+    $edit['scheme'] = '';
+
+    $edit['palette[bg]'] = '#abcdefg';
+    $this->drupalPost($settings_path, $edit, t('Save configuration'));
+    $this->assertText('Main background must be a valid hexadecimal CSS color value');
+
+    $edit['palette[bg]'] = '#z01234';
+    $this->drupalPost($settings_path, $edit, t('Save configuration'));
+    $this->assertText('Main background must be a valid hexadecimal CSS color value');
+  }
 }