Heine

  • home
  • drupal
  • drupal core commits
  • about
Home › Drupal Core Commits

Commit 340634 by dries

- Patch #681782 by Dave Reid: 'clean' option in token_replace() does not do anything.

--- <a href="http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc" title="http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc" rel="nofollow">http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc</a>      2010/01/25 10:38:34     1.8
+++ <a href="http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc" title="http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc" rel="nofollow">http://drupalcode.org/viewvc/drupal/drupal/includes/token.inc</a>      2010/03/12 14:33:02     1.9
@@ -78,6 +78,9 @@
   $replacements = array();
   foreach (token_scan($text) as $type => $tokens) {
     $replacements += token_generate($type, $tokens, $data, $options);
+    if (!empty($options['clear'])) {
+      $replacements += array_fill_keys($tokens, '');
+    }
   }
 
   // Optionally alter the list of replacement values.

--- <a href="http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test" title="http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test" rel="nofollow">http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test</a>      2010/03/06 06:39:01     1.116
+++ <a href="http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test" title="http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test" rel="nofollow">http://drupalcode.org/viewvc/drupal/drupal/modules/system/system.test</a>      2010/03/12 14:33:02     1.117
@@ -1449,26 +1449,30 @@
     $source .= '[node:author:name]';   // Node author's name
     $source .= '[node:created:since]'; // Time since the node was created
     $source .= '[current-user:name]';  // Current user's name
-    $source .= '[user:name]';          // No user passed in, should be untouched
     $source .= '[date:short]';         // Short date format of REQUEST_TIME
-    $source .= '[bogus:token]';        // Nonexistent token, should be untouched
+    $source .= '[user:name]';          // No user passed in, should be untouched
+    $source .= '[bogus:token]';        // Non-existent token
 
     $target  = check_plain($node->title);
     $target .= check_plain($account->name);
     $target .= format_interval(REQUEST_TIME - $node->created, 2, $language->language);
     $target .= check_plain($user->name);
-    $target .= '[user:name]';
     $target .= format_date(REQUEST_TIME, 'short', '', NULL, $language->language);
-    $target .= '[bogus:token]';
 
+    // Test that the clear parameter cleans out non-existent tokens.
+    $result = token_replace($source, array('node' => $node), array('language' => $language, 'clear' => TRUE));
+    $result = $this->assertFalse(strcmp($target, $result), 'Valid tokens replaced while invalid tokens cleared out.');
+
+    // Test without using the clear parameter (non-existant token untouched).
+    $target .= '[user:name]';
+    $target .= '[bogus:token]';
     $result = token_replace($source, array('node' => $node), array('language' => $language));
+    $this->assertFalse(strcmp($target, $result), 'Valid tokens replaced while invalid tokens ignored.');
 
     // Check that the results of token_generate are sanitized properly. This does NOT
     // test the cleanliness of every token -- just that the $sanitize flag is being
     // passed properly through the call stack and being handled correctly by a 'known'
     // token, [node:title].
-    $this->assertFalse(strcmp($target, $result), t('Basic placeholder tokens replaced.'));
-
     $raw_tokens = array('title' => '[node:title]');
     $generated = token_generate('node', $raw_tokens, array('node' => $node));
     $this->assertFalse(strcmp($generated['[node:title]'], check_plain($node->title)), t('Token sanitized.'));

No votes yet
  • Drupal Core
  • Download patch

Recent posts

  • Planet Drupal past and current
  • Help! - Cannot access a global variable.
  • Why is my module's update hook not listed on update.php's selection form?
  • How do I add a class to a link generated with l()
  • ZeroDayScan - Full path disclosure bug in Drupal 6.16 (0day)
more

Security reviews

  • Afraid custom code makes your site vulnerable?
  • You don't really trust that module you just downloaded from Drupal.org?

Sleep better after a security review.

Tags

Captcha CSRF Drupal embed Input Format modx OpenID Performance Planet Drupal rants Security Varnish
more tags
  • home
  • drupal
  • drupal core commits
  • about

Copyright © 2010 by Heine Deelstra. All rights reserved.