Commit 99fb8ee3 authored by Henri MEDOT's avatar Henri MEDOT
Browse files

Fixed: make sure we do not return as suggestions menu item paths that will be...

Fixed: make sure we do not return as suggestions menu item paths that will be denied by the client-side plugin.
parent 9a7b1653
......@@ -332,3 +332,7 @@ function ckeditor_link_url($path = NULL, $langcode) {
return url($path, $options);
}
function _ckeditor_link_check_path($path) {
return preg_match('`^[a-z][\w\/\.-]*$`i', $path);
}
......@@ -31,10 +31,12 @@ function ckeditor_link_ckeditor_link_i18nmenu_autocomplete($string) {
$sql .= ' ORDER BY link_title';
$result = db_query_range($sql, $args, 0, 10);
while ($item = db_fetch_object($result)) {
$router_item = menu_get_item($item->link_path);
if ($router_item && $router_item['access']) {
$path = ckeditor_link_path_prefix_language($item->link_path, $item->language);
$matches[$path] = $item->link_title;
if (_ckeditor_link_check_path($item->link_path)) {
$router_item = menu_get_item($item->link_path);
if ($router_item && $router_item['access']) {
$path = ckeditor_link_path_prefix_language($item->link_path, $item->language);
$matches[$path] = $item->link_title;
}
}
}
}
......
......@@ -23,12 +23,14 @@ function ckeditor_link_ckeditor_link_menu_autocomplete($string) {
$sql .= ' ORDER BY link_title';
$result = db_query_range($sql, $args, 0, 10);
while ($item = db_fetch_object($result)) {
$router_item = menu_get_item($item->link_path);
if ($router_item && $router_item['access']) {
$options = unserialize($item->options);
$langcode = (isset($options['langcode'])) ? $options['langcode'] : '';
$path = ckeditor_link_path_prefix_language($item->link_path, $langcode);
$matches[$path] = $item->link_title;
if (_ckeditor_link_check_path($item->link_path)) {
$router_item = menu_get_item($item->link_path);
if ($router_item && $router_item['access']) {
$options = unserialize($item->options);
$langcode = (isset($options['langcode'])) ? $options['langcode'] : '';
$path = ckeditor_link_path_prefix_language($item->link_path, $langcode);
$matches[$path] = $item->link_title;
}
}
}
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment