system_theme_enable() can receive user-submitted vars from either GET or POST requests, which is fine. However, $_REQUEST is a merge of $_GET, $_POST and $_COOKIE. So if someone has a cookie named 'theme' -- and, yes, I only discovered this b/c I had a cookie named theme -- it will cause havoc on the page. You won't be able to enable a theme. Or you might enable the wrong theme (if the theme cookie is set to a value that is also a theme on your site).
More about how you shouldn't use $_REQUEST when you really want a merge of just $_GET and $_POST.
http://brian.moonspot.net/2008/01/17/responsible-use-of-the-_request-var...
Patch forthcoming.
| Comment | File | Size | Author |
|---|
Comments
Comment #1
crookednumber commentedPatch ....
Comment #2
damien tournoud commentedSounds good, but at the minimum we need some comments in there, or someone might want to "fix" this down the road :)
Comment #3
crookednumber commentedThanks, Damien. Attaching patch with comments.
Comment #4
crookednumber commentedForgot to change STATUS.
Comment #5
crookednumber commented#3: remove_dollar_REQUEST_from_system_theme_enable-system_theme_enable-1138874-4394220.patch queued for re-testing.
Comment #7
crookednumber commentedRe-rolling for architecture change of 11/1/2011.
http://groups.drupal.org/node/179649
Comment #8
crookednumber commentedRe-roll.
Comment #9
crookednumber commentedComment #10
kscheirer#8: remove_dollar_REQUEST_from_system_theme_enable-system_theme_enable-1138874-7.patch queued for re-testing.
Comment #11
kscheirerRetesting against latest HEAD since it has been over a year.
Comment #12
areke commentedSadly, half a year later, the patch no longer applies.
Comment #13
marvil07 commentedNot sure about how Request object is built, but trusting in symfony, it seems like this patch will not be relevant anymore.
I can be wrong, please confirm and re-open if necessary.
Comment #14
sam hermans commentedJust re-rolled it, patch is no longer relevant. I confirm it can be closed.