Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer content types' permissions, to inject arbitrary web script or HTML via unspecified vectors when displaying content type names. Per: http://www.madirish.net/?article251
Patch
Applying the following patch mitigates these threats.
--- service_links/service_links.module 2008-02-26 12:01:27.000000000 -0500
+++ service_links/service_links.module 2009-10-02 06:33:21.000000000 -0400
@@ -35,11 +35,12 @@ function service_links_admin_settings()
'#title' > t('Where to show the service links'),
'#description' > t('Set the node types and categories you want to display links for.'),
);
+ $names array_map('filter_xss', node_get_types('names'));
$form['where_to_show_the_links']['service_links_node_types'] array(
'#type' > 'checkboxes',
'#title' > t('Node types'),
'#default_value' > variable_get('service_links_node_types', array()),
- '#options' > node_get_types('names'),
+ '#options' > $names,
);
if (module_exists('taxonomy')) {
$form['where_to_show_the_links']['service_links_category_types'] array(
Publication date: Fri, 09 Oct 2009 19:30:00 +0000