0

Is there any other way to create more secure link in a drupal_set_message??

$loglink = l("bla bla", 'admin/config/services/blabla');
  drupal_set_message(t("You should not have empty or the default fields in $loglink. You have to fill your own information."), 'error');
  • 1
    What do you mean by "secure" in this context? – Clive May 14 '15 at 8:23
  • I mean more security options exept that above – Karmen May 14 '15 at 8:26
  • 1
    What "security options" are above? Are you sure you mean "security"? – Clive May 14 '15 at 8:32
  • Maybe from the other end: why do you think links as they are now are not secure enough? If we don't know what you think is wrong, we can't tell how to make it better. – Mołot May 14 '15 at 8:52
  • Running your link through t() opens it to be altered by anybody with translation permissions. It's probably not your intent so you should translate strings and have the link be a variable passed to t(). – Ben May 14 '15 at 10:17
1

No, there isn't a more secure way, especially when you are not outputting input coming from the user. Still, you should be using t()-placeholders.

Drupal core uses the following code, when outputting an URL.

// system_requirements()
$requirements ['php'] = array(
  'title' => $t('PHP'),
  'value' => $phpversion,
  'description' => $t('The phpinfo() function has been disabled for security reasons. To see your server\'s phpinfo() information, change your PHP settings or contact your server administrator. For more information, <a href="@phpinfo">Enabling and disabling phpinfo()</a> handbook page.', array('@phpinfo' => 'http://drupal.org/node/243993')),
  'severity' => REQUIREMENT_INFO,
);
  // action_synchronize()
  $link = l(t('Remove orphaned actions'), 'admin/config/system/actions/orphan');
  $count = count($actions_in_db);
  $orphans = implode(', ', $orphaned);
  watchdog('actions', '@count orphaned actions (%orphans) exist in the actions table. !link', array('@count' => $count, '%orphans' => $orphans, '!link' => $link), WATCHDOG_INFO);

The only difference is that, in the first case, the code is outputting an external URL while, in the other case, the URL is internal to the website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.