Make group labels localizable, please

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Stalski’s picture

Status: Active » Closed (fixed)

ok, sorry for that ;)

fixed and committed

andypost’s picture

Priority: Normal » Critical
Status: Closed (fixed) » Needs work

There's security issue with this fix http://drupal.org/cvs?commit=468534

<span class="field-group-format-toggler">' . t($group->label) . '</span>

User input printed without validation!!!

nils.destoop’s picture

Status: Needs work » Fixed

$group->label now goes to check_plain.

andypost’s picture

Status: Fixed » Needs review
FileSize
1.44 KB

Suppose this should be check_plain(t($group->label)) and another missed place with direct output

andypost’s picture

FileSize
1.39 KB

Using %group is enough for check_plain()

nils.destoop’s picture

Status: Needs review » Fixed

Patch applied

andypost’s picture

Priority: Critical » Major
Status: Fixed » Reviewed & tested by the community
+++ field_group.field_ui.inc	25 Dec 2010 15:48:25 -0000
@@ -455,7 +455,7 @@ function field_group_delete_form($form, 
   $output = confirm_form($form,
-    t('Are you sure you want to delete the group %group?', array('%group' => check_plain(t($group->label)))),
+    t('Are you sure you want to delete the group %group?', array('%group' => t($group->label))),

This hunk is lost before commit!!!

Also I'd like to point that core does not translate a strings that are user defined - this task for l18n module

Powered by Dreditor.

nils.destoop’s picture

Status: Reviewed & tested by the community » Fixed

Second line of patch also committed.

Thx for the Dreditor link. Didn't know that one. Very usefull for small patches.
Hope Chrome support works fast. :)

Stalski’s picture

Status: Fixed » Closed (fixed)

Nice job ;)

carajito’s picture

Component: User interface » Code
Status: Closed (fixed) » Active

This will be incorporated into the next update?

nils.destoop’s picture

Status: Active » Closed (fixed)

This is on dev. So it will idd be incorporated into the next update.

carajito’s picture

an estimated date???

carajito’s picture

It is not on the 7.x - 2.x-dev yet

adelka’s picture

subscribe - solution for 7?