Tag1 D7ES Announcements

The Outline Designer module failed to verify that a target content type was in the site's allowed book types list and that the user had create permission on that type before performing a node type change, allowing authenticated users to change node types beyond their permitted scope.

The Boost module failed to exclude pages with a `?destination=` query parameter from its static file cache due to a PHP undefined-variable bug, allowing anonymous visitors to cause such pages to be cached and later served incorrectly to other users.

The `_cleantalk_die()` function outputs the CleanTalk API response message directly into HTML without sanitization. An attacker who can influence the CleanTalk cloud API response could inject arbitrary HTML or JavaScript into the page shown to blocked users.

The SpamFireWall (SFW) "block" page reflects the request URI and the blocked IP address into HTML without sanitization, allowing an attacker to break out of an `href` attribute and execute arbitrary JavaScript in the victim's browser.

A logic error in `antispam_access_callback()` causes the spam-moderator permission check to never execute, allowing any authenticated user to perform spam moderation operations (marking content as spam, publishing/unpublishing) regardless of their role.

The Boolean module fails to sanitize admin-configured prefix and suffix strings before rendering them in the field formatter, allowing a user with field administration privileges to inject arbitrary HTML or JavaScript that executes in the browser of any visitor viewing content with that field.

The Friendly Register module exposed unauthenticated AJAX endpoints for checking username and email availability without CSRF token validation, allowing any external site or script to enumerate valid usernames and email addresses on the Drupal site.

The Icon API: Menu submodule outputs a user-supplied CSS class string directly into HTML without sanitization, allowing a user with menu icon administration privileges to inject arbitrary JavaScript into menu link markup.

The Fit Text module embeds admin-supplied jQuery selectors directly into inline JavaScript without encoding, allowing a user with the "administer fittext" permission to inject arbitrary JavaScript that executes in every site visitor's browser on every page load.

The Node View Permissions module fails to exclude anonymous users from its "view own content" permission check. Because Drupal represents anonymous users with uid=0, any node reassigned to uid=0 (e.g., after an account cancellation) becomes accessible to anonymous users who hold a "view own [type] content" permission.