One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. The core is at 7.64 which should be sanitizing its requests, but the module may not. Some requests the vendor attempted using GET:

/slideshow/my-slide?pass=&destination=node%2f170&form_build_id= form-hash&form_id=user_login_bloc 

Going on the theory that this module is not secure should I modify this module and submit a patch, or find a replacement that works with Drupal 7 Views and sanitizes its requests? Or am I missing what's really going on here?

thx, sam

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.