Commit f690345c authored by Florian Radut's avatar Florian Radut
Browse files

- Fixed stored XSS vulnerabilities involving menu icon titles and submenu labels. 

- Improved HTML filtering for translated slideshow text and author/date labels, and escaped content-type labels in developer links.
- Preserved translation support and safe HTML in slide descriptions, including links, line breaks and emphasis.
- Fixed multilingual slide links by resolving URL aliases before generating links in the current language.
- Improved caching for translated text and multilingual slide links.
- Hardened custom CSS file validation.
- Fixed #3630998: TypeError: in_array() argument #2 must be of type array, string given in preprocessAggregatorContainer().
parent af1cec98

CHANGELOG.txt

+8 −8
Changes for CHANGELOG.txt: 8 added lines, 8 removed lines.
Original line number Diff line number Diff line 
Black Hole 2.0.1 (2026-10-03)

=============================

Black Hole 2.0.1 (2026-10-17)

============================



- Hardened Font Awesome menu titles, including nested menu items.

- Separated plain submenu labels from icon markup and escaped attributes.
@@ -10,14 +10,14 @@ Black Hole 2.0.1 (2026-10-03) 
  current URL language. Retained query strings, fragments and external URLs.

- Added cache dependencies for translated text and language-aware aliases.

- Restricted custom CSS to real .css files within the Drupal installation.

- Updated slideshow field guidance.

- Fixed a container preprocessing TypeError when CSS classes are supplied as

  a string. Preserved Aggregator layout classes for string and array input.

- Aligned block-content widths, responsive User blocks, Cards and Media layouts.

- Added selected Media widget styling and contained published Media galleries.

- TypeError: in_array() argument #2 must be of type array, string given in 

  preprocessAggregatorContainer().



After upgrading, rebuild Drupal caches per site.



Black Hole 2.0.0

===============

================



Black Hole 2.0 modernizes the familiar theme for Drupal 11.4+ and Drupal 12.
@@ -46,4 +46,4 @@ UPGRADING 
  installation using the theme. No database update is required.

- Transfer old social URL settings to the Social media links menu.

- Keep personal CSS and assets outside the theme directory.

- Adjust bundled slide URLs if installed outside /themes/contrib/black_hole.
 
- Adjust relative image URLs if you move the example stylesheet.

Readme.md

+157 −282

File changed.

Preview size limit exceeded, changes collapsed.

_custom/README.txt

+11 −14
Changes for _custom/README.txt: 11 added lines, 14 removed lines.
Original line number Diff line number Diff line 
BLACK HOLE 2.0.0 - CUSTOMIZATION EXAMPLES

BLACK HOLE - CUSTOMIZATION EXAMPLES

======================================



This directory contains a sample stylesheet and bundled demonstration images.
@@ -10,8 +10,7 @@ CUSTOM CSS 
1. Copy example.custom-style.css outside the Black Hole directory, for example:

   web/themes/custom/black_hole-custom.css

2. In Appearance > Black Hole > Settings > Theme customization > Custom CSS

   file,

   enter /themes/custom/black_hole-custom.css (relative to Drupal's web root).

   file, enter /themes/custom/black_hole-custom.css (relative to Drupal's web root).

3. Rebuild caches for the affected site. In multisite, repeat per site.



You may use another local directory outside Black Hole. Remote stylesheet URLs
@@ -20,17 +19,20 @@ updated when you replace the theme: compare and merge changes yourself. 


WHAT IS ACTIVE IN THE EXAMPLE?

------------------------------

The example enables branding, content-image floats, sidebar borders and

responsive sidebar columns, a 10em slider-image minimum height, and cookie

button styling. Remove any rules you do not want. Optional examples remain

commented out. Responsive rules are grouped at the bottom of the stylesheet.

Branding, the decorative sidebar background, the mobile header-background

rule and EU Cookie Compliance styling are active.

All customization examples are commented out, including image floats,

slideshow minimum height and sidebar borders. Uncomment only the examples

you need. Media galleries, field separation, block widths and component

spacing are part of the theme and do not depend on this example file.

Responsive rules are grouped at the bottom of the stylesheet.



ICON CUSTOMIZATION

------------------

Prefer Layout settings > Icon colors for social and page icon colors.

The example also documents CSS variables; leave the corresponding settings

blank to use those variables. Both SVG and Font Awesome use the same colors.

The Other social network image example hides either renderer. When using a

blank to use those variables. The theme uses its local SVG sprites.

The Other social network image example hides the normal SVG icon. When using a

personal copy, update its image URL as well. Page icons must be enabled for

page/file icon color rules to have an effect.
@@ -70,8 +72,3 @@ and the built-in Aggregator latest-items page when that module is enabled. 
Zebra colors are shared by these listings. Empty color fields use defaults;

icon placeholders and pickers preview the selected shipped palette. Custom CSS

may change the actual inherited link color.
 


optional-layouts.html contains copyable markup for manually authored sections,

cards, image/text splits, features, buttons and videos. It is not loaded by the

theme and is not required by the settings controls. Supply your own content,

links and media; use a trusted text format or a theme template.

_custom/example.custom-style.css

+304 −388

File changed.

Preview size limit exceeded, changes collapsed.

_custom/optional-layouts.html

deleted100644 → 0
+0 −65
Changes for _custom/optional-layouts.html: 0 added lines, 65 removed lines.
Original line number Diff line number Diff line 
<!-- Copy individual patterns into trusted blocks or templates. This file is not

     loaded by the theme. Supply your own text, links and media.

     For ordinary Views listings and /aggregator, use Content layouts in theme

     settings instead. These examples are for manually authored content. -->



<!-- Section and image/text split. Remove layout-split--reverse for normal order. -->

<section class="layout-section layout-space-normal">

  <div class="layout-section__inner">

    <div class="pure-g layout-split layout-split--reverse">

      <div class="pure-u-1 pure-u-md-1-2">

        <img src="/sites/default/files/example-image.jpg" alt="Describe the image" width="800" height="450" loading="lazy">

      </div>

      <div class="pure-u-1 pure-u-md-1-2">

        <h2>Section heading</h2>

        <p>Your introduction or explanation.</p>

        <a class="layout-button" href="/about">Learn more</a>

      </div>

    </div>

  </div>

</section>



<!-- Cards. Duplicate a column for each card; PureCSS controls column count. -->

<div class="pure-g layout-cards">

  <div class="pure-u-1 pure-u-md-1-2 pure-u-lg-1-4">

    <article class="layout-card">

      <h3>Card heading</h3>

      <p>A short description.</p>

      <div class="layout-card__actions">

        <a class="layout-button layout-button--outline" href="/about">Explore</a>

      </div>

    </article>

  </div>

  <div class="pure-u-1 pure-u-md-1-2 pure-u-lg-1-4">

    <article class="layout-card layout-card--featured">

      <p>Featured</p>

      <h3>Featured card</h3>

      <p>A longer description demonstrates how the action stays at the bottom.</p>

      <div class="layout-card__actions">

        <a class="layout-button" href="/about">Explore</a>

      </div>

    </article>

  </div>

</div>



<!-- Features. Duplicate the column as needed. A decorative icon has empty alt. -->

<div class="pure-g layout-features">

  <div class="pure-u-1 pure-u-md-1-2 pure-u-lg-1-4">

    <div class="layout-feature">

      <img class="layout-feature__icon" src="/sites/default/files/example-icon.svg" alt="" width="32" height="32">

      <div class="layout-feature__body">

        <h3>Feature heading</h3>

        <p>A short explanation.</p>

      </div>

    </div>

  </div>

</div>



<!-- Video. Supply actual video, poster and caption files; no autoplay. -->

<div class="layout-video">

  <video controls preload="none" poster="/sites/default/files/example-poster.jpg">

    <source src="/sites/default/files/example-video.mp4" type="video/mp4">

    <track kind="captions" src="/sites/default/files/example-captions.vtt" srclang="en" label="English" default>

    <a href="/sites/default/files/example-video.mp4">Download the video</a>

  </video>

</div>