0

I'm trying to write a patch to make module Drupal coding standards.

And this one the complains that have and I do not know how to fix it.

Line 148: the use of REQUEST_URI is prone to XSS exploits and does not work on IIS; use request_uri() instead [security_12] return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";

Here is the function that is been affecting.

function module_get_url() {
   return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
}

I know that I need to implement request_ui but I'm not sure.

It should looks like this .... ?

   function module_request_uri() {
       return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
    }

Any help will be appreciated on how can fix this complain.

2

It means replace $_SERVER['REQUEST_URI'] with request_uri().

So module_get_url() needs to change slightly.

function module_get_url() {
  $uri = request_uri();
  return "http" . (isset($_SERVER['HTTPS']) ? "s" : "") . "://" . "{$_SERVER['HTTP_HOST']}{$uri}";
}
1

Simply swap out $_SERVER['REQUEST_URI'] with request_uri().

The reasoning is that $_SERVER['REQUEST_URI'] is Apache specific.

From the function documentation page:

Returns the equivalent of Apache's $_SERVER['REQUEST_URI'] variable.

Because $_SERVER['REQUEST_URI'] is only available on Apache, we generate an equivalent using other environment variables.

0

Try:

function module_get_url() {
  return url(current_path(), array('absolute' => true));
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.