C
и в чём проблема?
Size: a a a
2020 September 16
V
не попадаю)
C
начни с menu_execute_active_handler
V
сча попробую дебажнуть
V
начни с menu_execute_active_handler
самое интресное открываю все формы и никогда в form_builder не попадает
C
что-то не так делаешь
V
подскажи может при каком условии он вызывается, когда форму открываешь?
C
всегда вызывается
V
лан буду искать, а вот это к чему? что за after_build?
// The #after_build flag allows any piece of a form to be altered
// after normal input parsing has been completed.
if (isset($form['#after_build']) && !isset($form['#after_build_done']))
// The #after_build flag allows any piece of a form to be altered
// after normal input parsing has been completed.
if (isset($form['#after_build']) && !isset($form['#after_build_done']))
SP
А ты кеш скинь
V
Алексей Кузнецов
конкретно в этом куске нет ничего несекьюрного
подскажи плиз нужно вызывать call_user_func_array($function, [&$form, &$form_state]) именно с параметрами переданными по ссылке? почему?
АК
Vitaly
подскажи плиз нужно вызывать call_user_func_array($function, [&$form, &$form_state]) именно с параметрами переданными по ссылке? почему?
Надо смотреть, как в хук форм альтер они передаются, так и тут передавать
V
Алексей Кузнецов
Надо смотреть, как в хук форм альтер они передаются, так и тут передавать
V
по ссылке
АК
ну вот значит надо по ссылке оба параметра
V
спасибо
AI
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007
https://www.drupal.org/sa-core-2020-007
Project: Drupal core (https://www.drupal.org/project/drupal)Date: 2020-September-16Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingCVE IDs: CVE-2020-13666Description: The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.Solution: Install the latest version:
If you are using Drupal 7.x, upgrade to Drupal 7.73 (https://www.drupal.org/project/drupal/releases/7.73).
If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10 (https://www.drupal.org/project/drupal/releases/8.8.10).
If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6 (https://www.drupal.org/project/drupal/releases/8.9.6).
If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6 (https://www.drupal.org/project/drupal/releases/9.0.6).
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.10.
If you were previously relying on Drupal's AJAX API to perform trusted JSONP requests, you'll either need to override the AJAX options to set "jsonp: true", or you'll need to use the jQuery AJAX API directly.
If you are using jQuery's AJAX API for user-provided URLs in a contrib or custom module, you should review your code and set "jsonp: false" where this is appropriate.Reported By: Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Fixed By: Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Théodore Biadala (https://www.drupal.org/user/598310)
Lee Rowlands (https://www.drupal.org/user/395439) of the Drupal Security Team
David Snopek (https://www.drupal.org/user/266527) of the Drupal Security Team
Nathaniel Catchpole (https://www.drupal.org/user/35733) of the Drupal Security Team
Alex Bronstein (https://www.drupal.org/user/78040) of the Drupal Security Team
Drew Webber (https://www.drupal.org/user/255969) of the Drupal Security Team
https://www.drupal.org/sa-core-2020-007
Project: Drupal core (https://www.drupal.org/project/drupal)Date: 2020-September-16Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingCVE IDs: CVE-2020-13666Description: The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.Solution: Install the latest version:
If you are using Drupal 7.x, upgrade to Drupal 7.73 (https://www.drupal.org/project/drupal/releases/7.73).
If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10 (https://www.drupal.org/project/drupal/releases/8.8.10).
If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6 (https://www.drupal.org/project/drupal/releases/8.9.6).
If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6 (https://www.drupal.org/project/drupal/releases/9.0.6).
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.10.
If you were previously relying on Drupal's AJAX API to perform trusted JSONP requests, you'll either need to override the AJAX options to set "jsonp: true", or you'll need to use the jQuery AJAX API directly.
If you are using jQuery's AJAX API for user-provided URLs in a contrib or custom module, you should review your code and set "jsonp: false" where this is appropriate.Reported By: Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Fixed By: Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Théodore Biadala (https://www.drupal.org/user/598310)
Lee Rowlands (https://www.drupal.org/user/395439) of the Drupal Security Team
David Snopek (https://www.drupal.org/user/266527) of the Drupal Security Team
Nathaniel Catchpole (https://www.drupal.org/user/35733) of the Drupal Security Team
Alex Bronstein (https://www.drupal.org/user/78040) of the Drupal Security Team
Drew Webber (https://www.drupal.org/user/255969) of the Drupal Security Team
AI
Понеслась!
C
да там ничего серьёзного
AI
да там ничего серьёзного
Опять все проекты обновлять