* Advisory ID: DRUPAL-SA-CONTRIB-2012-055 * Project: Fusion [1] (third-party theme) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
Fusion is a base theme that provides a configurable grid system and modular styling for common Drupal UI components.
The theme outputs a CSS class for the tag based on the current URL, but does not provide sufficient filtering to prevent a Cross site scripting (XSS) attack.
This vulnerability affects all sub-themes of Fusion.
-------- VERSIONS AFFECTED ---------------------------------------------------
* Fusion 6.x-1.x versions prior to 6.x-1.13
Drupal core is not affected. If you do not use the contributed Fusion [3] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
If you utilize Fusion or a Fusion-based theme, you should upgrade to Fusion 6.x-1.13 [4].
* Most Fusion sub-themes will inherit this fix. * If you copied code from Fusion core's template.php file into a custom sub-theme's template.php file you should compare your code to the changes made in this release to ensure the vulnerability has not been duplicated. In YOURTHEME_preprocess_page() look for this code: $vars['body_id'] = 'pid-' . strtolower(preg_replace('/[_+/]/', '-', drupal_get_path_alias($_GET['q'])));
If this code exists within your sub-theme, there are two possible solutions:
1) *Recommended:* Delete the line of code. It is unnecessary in your sub-theme since the sub-theme will inherit this functionality from Fusion Core 2) Replace the code with the following: $vars['body_id'] = 'pid-' .
strtolower(fusion_core_clean_css_identifier(drupal_get_path_alias($_GET['q'])));
fusion_core_clean_css_identifier() is a function added in this security release of Fusion. Making this change to your sub-theme's code without updating Fusion core will result in a WSOD.
Also see the Fusion [5] project page.
-------- REPORTED BY ---------------------------------------------------------
* Jakub Suchy [6], of the Drupal Security Team * Justin Emond [7] * Rick Manelius [8] * Abhishek Nagar [9] * Chris Lee [10]
-------- FIXED BY ------------------------------------------------------------
* Jason Yergeau [11], theme co-maintainer * Sheena Donnelly [12], theme co-maintainer
-------- COORDINATED BY ------------------------------------------------------
* Derek Wright [13] of the Drupal Security Team * Stéphane Corlosquet [14] of the Drupal Security Team * Greg Knaddison [15] of the Drupal Security Team * David Rothstein [16] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [17].
Learn more about the Drupal Security team and their policies [18], writing secure code for Drupal [19], and securing your site [20].
[1] http://drupal.org/project/fusion [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/fusion [4] http://drupal.org/node/1506600 [5] http://drupal.org/project/fusion [6] http://drupal.org/user/31977 [7] http://drupal.org/user/186334 [8] http://drupal.org/user/680072 [9] http://drupal.org/user/259737 [10] http://drupal.org/user/1117072 [11] http://drupal.org/user/162308 [12] http://drupal.org/user/380305 [13] http://drupal.org/user/46549 [14] http://drupal.org/user/52142 [15] http://drupal.org/user/36762 [16] http://drupal.org/user/124982 [17] http://drupal.org/contact [18] http://drupal.org/security-team [19] http://drupal.org/writing-secure-code [20] http://drupal.org/security/secure-configuration