SA-CONTRIB-2009-052: remove multiple XSS vulnerabilities

Several updates to comply with current D7

print.admin.inc

@@ -29,7 +29,9 @@ function print_main_settings() {
     '#size' => 60,
     '#maxlength' => 250,
     '#description' => t('The URL to your custom print cascading stylesheet, if any. When none is specified, the default module CSS file is used.') . '<br />' .
-                      t('Macros: %b (base path: "%base"), %t (path to theme: "%theme")', array('%base' => base_path(), '%theme' => path_to_theme())),
+                      t('Macros: %b (base path: "%base"), %t (path to theme: "%theme")', array('%base' => base_path(), '%theme' => path_to_theme())) . '<br />' .
+                      t('Requires the <em>administer site configuration</em> permission.'),
+    '#disabled' => !user_access('administer site configuration'),
   );
 
   $form['settings']['print_urls'] = array(
@@ -147,6 +149,8 @@ function print_main_settings() {
  * Validate print_main_settings form.
  */
 function _print_main_settings_validate($form, &$form_state) {
+  global $base_url;
+
   // Check for a new uploaded logo, and use that instead.
   if ($file = file_save_upload('print_logo_upload', array('file_validate_is_image' => array()))) {
     $parts = pathinfo($file->filename);
@@ -160,6 +164,13 @@ function _print_main_settings_validate($form, &$form_state) {
       $form_state['values']['print_logo_url'] = base_path() . $file->filepath;
     }
   }
+
+  // Check that the stylesheet URL is a local URL, if it is an absolute URL, then it must start with the site's base URL
+  if (preg_match('!^http://.*!', $form_state['values']['print_css'], $matches)) {
+    if (!preg_match("!^$base_url/!", $matches[0])) {
+      form_set_error('print_css', t("Stylesheet URL must be a relative path or start with the site's base URL"));
+    }
+  }
 }
 
 /**

print.install

@@ -9,7 +9,7 @@
  */
 
 /**
- * Implementation of hook_install().
+ * Implements hook_install().
  */
 function print_install() {
   drupal_install_schema('print');
@@ -21,7 +21,7 @@ function print_install() {
 }
 
 /**
- * Implementation of hook_uninstall().
+ * Implements hook_uninstall().
  */
 function print_uninstall() {
   drupal_uninstall_schema('print');
@@ -69,7 +69,7 @@ function print_uninstall() {
 }
 
 /**
- * Implementation of hook_schema().
+ * Implements hook_schema().
  */
 function print_schema() {
   $schema['print_node_conf'] = array(

print.module

@@ -79,9 +79,9 @@ define('PRINT_ALLOW_BOOK_LINK', 2);
 define('PRINT_TYPE_FIELDS_WEIGHT', 30);
 
 /**
- * Implementation of hook_perm().
+ * Implements hook_permission().
  */
-function print_perm() {
+function print_permission() {
   return array(
     'access print' => array(
       'title' => t('Access the printer-friendly page'),
@@ -99,7 +99,7 @@ function print_perm() {
 }
 
 /**
- * Implementation of hook_theme().
+ * Implements hook_theme().
  */
 function print_theme() {
   return array(
@@ -110,7 +110,7 @@ function print_theme() {
 }
 
 /**
- * Implementation of hook_menu().
+ * Implements hook_menu().
  */
 function print_menu() {
   $items = array();
@@ -120,6 +120,7 @@ function print_menu() {
     'page callback' => 'print_controller_html',
     'access arguments' => array('access print'),
     'type' => MENU_CALLBACK,
+    'file' => 'print.pages.inc',
   );
   $items[PRINT_PATH . '/' . PRINT_PATH] = array(
     'page callback' => 'drupal_access_denied',
@@ -130,6 +131,7 @@ function print_menu() {
     'page callback' => 'drupal_get_form',
     'page arguments' => array('print_html_settings'),
     'access arguments'  => array('administer print'),
+    'file' => 'print.admin.inc',
   );
   $items['admin/settings/print/html'] = array(
     'title' => 'Web page',
@@ -148,6 +150,7 @@ function print_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 2,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print.admin.inc',
   );
   $items['admin/settings/print/common'] = array(
     'title' => 'Settings',
@@ -156,6 +159,7 @@ function print_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 10,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print.admin.inc',
   );
   $items['admin/settings/print/common/options'] = array(
     'title' => 'Options',
@@ -169,13 +173,14 @@ function print_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 2,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print.admin.inc',
   );
 
   return $items;
 }
 
 /**
- * Implementation of hook_block_list().
+ * Implements hook_block_list().
  */
 function print_block_list() {
       $block[0]['info'] = t('Printer, e-mail and PDF versions');
@@ -184,7 +189,7 @@ function print_block_list() {
 }
 
 /**
- * Implementation of hook_block_view().
+ * Implements hook_block_view().
  */
 function print_block_view($delta = 0) {
       switch ($delta) {
@@ -224,7 +229,7 @@ function print_block_view($delta = 0) {
 }
 
 /**
- * Implementation of hook_link_alter().
+ * Implements hook_link_alter().
  */
 function print_link_alter(array &$links, $node) {
   foreach ($links as $module => $link) {
@@ -263,13 +268,13 @@ function print_link_alter(array &$links, $node) {
 }
 
 /**
- * Implementation of hook_help().
+ * Implements hook_help().
  */
 function print_help($path, $arg) {
   switch ($path) {
     case 'admin/help#print':
       // Return a line-break version of the module README
-      return filter_filter('process', 1, NULL, file_get_contents(drupal_get_path('module', 'print') . '/README.txt') );
+      return _filter_autop(file_get_contents(drupal_get_path('module', 'print') . '/README.txt'));
   }
 
   $print_html_link_pos = variable_get('print_html_link_pos', array(PRINT_HTML_LINK_POS_DEFAULT => PRINT_HTML_LINK_POS_DEFAULT));
@@ -288,12 +293,12 @@ function print_help($path, $arg) {
 }
 
 /**
- * Implementation of hook_node_view().
+ * Implements hook_node_view().
  */
-function print_node_view($node, $teaser) {
+function print_node_view($node, $build_mode) {
   $print_html_link_pos = variable_get('print_html_link_pos', array(PRINT_HTML_LINK_POS_DEFAULT => PRINT_HTML_LINK_POS_DEFAULT));
   $print_html_link_use_alias = variable_get('print_html_link_use_alias', PRINT_HTML_LINK_USE_ALIAS_DEFAULT);
-  $allowed_type = print_link_allowed(array('type' => 'node', 'node' => $node, 'teaser' => $teaser));
+  $allowed_type = print_link_allowed(array('type' => 'node', 'node' => $node, 'teaser' => ($build_mode == 'teaser')));
   if (($allowed_type === PRINT_ALLOW_NORMAL_LINK) && !isset($node->book) && !empty($print_html_link_pos['link'])) {
     drupal_add_css(drupal_get_path('module', 'print') . '/css/printlinks.css');
     $links = array();
@@ -322,12 +327,13 @@ function print_node_view($node, $teaser) {
     );
 
     $node->content['links']['print_html'] = array(
-      '#type' => 'node_links',
-      '#value' => $links,
+      '#theme' => 'links',
+      '#links' => $links,
+      '#attributes' => array('class' => 'links inline'),
     );
   }
 
-  if (($teaser === FALSE) && isset($node->build_mode) && ($node->build_mode == NODE_BUILD_NORMAL)) {
+  if ($build_mode == 'full') {
       // Insert content corner links
       $node->content['print_links'] = array(
         '#markup' => "<span class='print-link'></span>",
@@ -343,7 +349,7 @@ function print_node_view($node, $teaser) {
 }
 
 /**
- * Implementation of hook_node_load().
+ * Implements hook_node_load().
  */
 function print_node_load($nodes, $types) {
   foreach ($nodes as $node) {
@@ -352,7 +358,7 @@ function print_node_load($nodes, $types) {
 }
 
 /**
- * Implementation of hook_node_update().
+ * Implements hook_node_update().
  */
 function print_node_update($node) {
   if (user_access('administer print') || user_access('node-specific print configuration')) {
@@ -361,7 +367,7 @@ function print_node_update($node) {
 }
 
 /**
- * Implementation of hook_node_delete().
+ * Implements hook_node_delete().
  */
 function print_node_delete($node) {
   db_delete('print_node_conf')
@@ -373,9 +379,9 @@ function print_node_delete($node) {
 }
 
 /**
- * Implementation of hook_form_alter().
+ * Implements hook_form_alter().
  */
-function print_form_alter(&$form, $form_state, $form_id) {
+function print_form_alter(&$form, &$form_state, $form_id) {
   // Add the node-type settings option to activate the printer-friendly version link
   if ((user_access('administer print') || user_access('node-specific print configuration')) &&
       (($form_id == 'node_type_form') || !empty($form['#node_edit_form']))) {
@@ -422,7 +428,7 @@ function print_form_alter(&$form, $form_state, $form_id) {
 }
 
 /**
- * Implementation of hook_cck_extra_fields().
+ * Implements hook_cck_extra_fields().
  */
 function print_cck_extra_fields($type_name) {
   $fields['print'] = array(
@@ -434,14 +440,14 @@ function print_cck_extra_fields($type_name) {
 }
 
 /**
- * Implementation of hook_cck_build_modes().
+ * Implements hook_field_build_modes().
  */
-function print_cck_build_modes() {
+function print_field_build_modes() {
   return array(
     'print' => array(
       'title' => t('Print'),
       'build modes' => array(
-        NODE_BUILD_PRINT => array(
+        'print' => array(
           'title' => t('Print'),
           'views style' => TRUE,
         ),
@@ -606,7 +612,7 @@ function theme_print_format_link() {
   $print_html_link_class = variable_get('print_html_link_class', PRINT_HTML_LINK_CLASS_DEFAULT);
   $print_html_new_window = variable_get('print_html_new_window', PRINT_HTML_NEW_WINDOW_DEFAULT);
   $print_html_show_link = variable_get('print_html_show_link', PRINT_HTML_SHOW_LINK_DEFAULT);
-  $print_html_link_text = variable_get('print_html_link_text', t('Printer-friendly version'));
+  $print_html_link_text = filter_xss(variable_get('print_html_link_text', t('Printer-friendly version')));
 
   $img = drupal_get_path('module', 'print') . '/icons/print_icon.gif';
   $title = t('Display a printer-friendly version of this page.');

print.pages.inc

@@ -176,7 +176,7 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
 
   if (!empty($print_css)) {
     $replace_pairs = array('%b' => base_path(), '%t' => path_to_theme());
-    $user_css = strip_tags(strtr($print_css, $replace_pairs));
+    $user_css = check_url(strtr($print_css, $replace_pairs));
   }
   else {
     drupal_add_css(drupal_get_path('module', 'print') . '/css/print.css');
@@ -229,25 +229,24 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
       $logo_url = strip_tags($print_logo_url);
       break;
   }
-  $print['logo'] = $logo_url ? "<img class='print-logo' src='$logo_url' alt='' />\n" : '';
+  $print['logo'] = $logo_url ? "<img class='print-logo' src='" . check_url($logo_url) . "' alt='' />\n" : '';
 
   switch ($print_footer_options) {
     case 0: // none
       $footer = '';
       break;
     case 1: // theme's
-      $footer = filter_xss_admin(variable_get('site_footer', FALSE)) . "\n" . theme('blocks', 'footer');
-      $logo_url = theme_get_setting('logo');
+      $footer = variable_get('site_footer', FALSE) . "\n" . theme('blocks', 'footer');
       break;
     case 2: // user-specifed
       $footer = $print_footer_user;
       break;
   }
-  $print['footer_message'] = $footer;
+  $print['footer_message'] = filter_xss_admin($footer);
 
   $published_site = variable_get('site_name', 0);
   if ($published_site) {
-    $print_text_published = variable_get('print_text_published', t('Published on %site_name'));
+    $print_text_published = filter_xss(variable_get('print_text_published', t('Published on %site_name')));
     $published = t($print_text_published, array('%site_name' => $published_site));
     $print['site_name'] = $published . ' (' . l($base_url, $base_url) . ')';
   }
@@ -267,11 +266,11 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
       $url .= '#comment-$cid';
     }
     $retrieved_date = format_date(REQUEST_TIME, 'small');
-    $print_text_retrieved = variable_get('print_text_retrieved', t('retrieved on %date'));
+    $print_text_retrieved = filter_xss(variable_get('print_text_retrieved', t('retrieved on %date')));
     $retrieved = t($print_text_retrieved, array('%date' => $retrieved_date));
     $print['printdate'] = $print_sourceurl_date ? " ($retrieved)" : '';
 
-    $source_url = variable_get('print_text_source_url', t('Source URL'));
+    $source_url = filter_xss(variable_get('print_text_source_url', t('Source URL')));
     $print['source_url'] = '<strong>' . $source_url . $print['printdate'] . ':</strong> ' . l($url, $url);
   }
   else {
@@ -282,11 +281,11 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
     $node_type = $node->type;
 
     if (theme_get_setting("toggle_node_info_$node_type")) {
-      $print_text_by = variable_get('print_text_by', t('By %author'));
+      $print_text_by = filter_xss(variable_get('print_text_by', t('By %author')));
       $by_author = ($node->name ? $node->name : variable_get('anonymous', t('Anonymous')));
       $print['submitted'] = t($print_text_by, array('%author' => $by_author));
 
-      $print_text_created = variable_get('print_text_created', t('Created %date'));
+      $print_text_created = filter_xss(variable_get('print_text_created', t('Created %date')));
       $created_datetime = format_date($node->created, 'small');
       $print['created'] = t($print_text_created, array('%date' => $created_datetime));
     }
@@ -307,7 +306,7 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
   $breadcrumb = drupal_get_breadcrumb();
   if (!empty($breadcrumb)) {
     $breadcrumb[] = menu_get_active_title();
-    $print['breadcrumb'] = implode(' > ', $breadcrumb);
+    $print['breadcrumb'] = filter_xss(implode(' > ', $breadcrumb));
   }
   else {
     $print['breadcrumb'] = '';
@@ -323,7 +322,7 @@ function _print_var_generator($node, $message = NULL, $cid = NULL) {
       for ($i = 0; $i < $max; $i++) {
         $pfp_links .= '[' . ($i + 1) . '] ' . $urls[$i] . "<br />\n";
       }
-      $links = variable_get('print_text_links', t('Links'));
+      $links = filter_xss(variable_get('print_text_links', t('Links')));
       $print['pfp_links'] = "<p><strong>$links:</strong><br />$pfp_links</p>";
     }
   }
@@ -561,7 +560,7 @@ function _print_generate_node($nid, $cid = NULL, $format = PRINT_HTML_FORMAT, $t
   $node->printing = TRUE;
 
   //use the proper build_mode
-  $node->build_mode = NODE_BUILD_PRINT;
+  $node->build_mode = 'print';
 
   // Turn off Pagination by the Paging module
   unset($node->pages);

print_mail/print_mail.inc

@@ -130,9 +130,9 @@ function print_mail_form($form_state) {
     $user_name = t('Someone');
   }
   $site_name = variable_get('site_name', t('an interesting site'));
-  $print_mail_text_subject = variable_get('print_mail_text_subject', t('!user has sent you a message from !site'));
+  $print_mail_text_subject = filter_xss(variable_get('print_mail_text_subject', t('!user has sent you a message from !site')));
   $form['fld_subject']['#default_value'] = t($print_mail_text_subject, array('!user' => $user_name, '!site' => $site_name, '!title' => $title));
-  $print_mail_text_content = variable_get('print_mail_text_content', '');
+  $print_mail_text_content = filter_xss(variable_get('print_mail_text_content', ''));
   $form['txt_message']['#default_value'] = t($print_mail_text_content);
 
   return $form;
@@ -246,7 +246,7 @@ function print_mail_form_submit($form, &$form_state) {
     }
     $cid = isset($form_state['values']['cid']) ? $form_state['values']['cid'] : NULL;
 
-    $print_mail_text_message = variable_get('print_mail_text_message', t('Message from sender'));
+    $print_mail_text_message = filter_xss_admin(variable_get('print_mail_text_message', t('Message from sender')));
     $sender_message = $print_mail_text_message . ':<br /><br /><em>' . nl2br(check_plain($form_state['values']['txt_message'])) . '</em>';
 
     $print = print_controller($form_state['values']['path'], $cid, PRINT_MAIL_FORMAT, $form_state['values']['chk_teaser'], $sender_message);
@@ -268,7 +268,7 @@ function print_mail_form_submit($form, &$form_state) {
       $ok = FALSE;
       if (function_exists('job_queue_add') && variable_get('print_mail_job_queue', PRINT_MAIL_JOB_QUEUE_DEFAULT)) {
         $use_job_queue = TRUE;
-        $this_file = drupal_get_path('module', 'print_mail') .'/print_mail.inc';
+        $this_file = drupal_get_path('module', 'print_mail') . '/print_mail.inc';
       }
       else {
         $use_job_queue = FALSE;
@@ -302,7 +302,7 @@ function print_mail_form_submit($form, &$form_state) {
         watchdog('print_mail', '%name [%from] sent %page to [%to]', array('%name' => $form_state['values']['fld_from_name'], '%from' => $form_state['values']['fld_from_addr'], '%page' => $form_state['values']['path'], '%to' => $form_state['values']['txt_to_addrs']));
         $site_name = variable_get('site_name', t('us'));
         $print_mail_text_confirmation = variable_get('print_mail_text_confirmation', t('Thank you for spreading the word about !site.'));
-        drupal_set_message(t($print_mail_text_confirmation, array('!site' => $site_name)));
+        drupal_set_message(check_plain(t($print_mail_text_confirmation, array('!site' => $site_name))));
 
         $nodepath = drupal_get_normal_path($form_state['values']['path']);
         db_update('print_mail_page_counter')
@@ -321,7 +321,7 @@ function print_mail_form_submit($form, &$form_state) {
 }
 
 /**
- * Implementation of hook_mail().
+ * Implements hook_mail().
  */
 function print_mail_mail($key, &$message, $params) {
   switch ($key) {

print_mail/print_mail.install

@@ -9,14 +9,14 @@
  */
 
 /**
- * Implementation of hook_install().
+ * Implements hook_install().
  */
 function print_mail_install() {
   drupal_install_schema('print_mail');
 }
 
 /**
- * Implementation of hook_uninstall().
+ * Implements hook_uninstall().
  */
 function print_mail_uninstall() {
   drupal_uninstall_schema('print_mail');
@@ -46,7 +46,7 @@ function print_mail_uninstall() {
 }
 
 /**
- * Implementation of hook_schema().
+ * Implements hook_schema().
  */
 function print_mail_schema() {
   $schema['print_mail_node_conf'] = array(

print_mail/print_mail.module

@@ -27,9 +27,9 @@ define('PRINT_MAIL_TEASER_CHOICE_DEFAULT', 1);
 define('PRINT_MAIL_JOB_QUEUE_DEFAULT', 0);
 
 /**
- * Implementation of hook_perm().
+ * Implements hook_permission().
  */
-function print_mail_perm() {
+function print_mail_permission() {
   return array(
     'access send to friend' => array(
       'title' => t('Access the Send To Friend functionality'),
@@ -39,7 +39,7 @@ function print_mail_perm() {
 }
 
 /**
- * Implementation of hook_theme().
+ * Implements hook_theme().
  */
 function print_mail_theme() {
   return array(
@@ -48,12 +48,13 @@ function print_mail_theme() {
     ),
     'print_mail_form' => array(
       'arguments' => array('form'),
+      'file' => 'print_mail.inc',
     ),
   );
 }
 
 /**
- * Implementation of hook_menu().
+ * Implements hook_menu().
  */
 function print_mail_menu() {
   $items = array();
@@ -64,6 +65,7 @@ function print_mail_menu() {
     'page arguments' => array('print_mail_form'),
     'access arguments' => array('access send to friend'),
     'type' => MENU_CALLBACK,
+    'file' => 'print_mail.inc',
   );
   $items[PRINTMAIL_PATH . '/' . PRINTMAIL_PATH] = array(
     'page callback' => 'drupal_access_denied',
@@ -75,6 +77,7 @@ function print_mail_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 2,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print_mail.admin.inc',
   );
   $items['admin/settings/print/email/options'] = array(
     'title' => 'Options',
@@ -88,13 +91,14 @@ function print_mail_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 2,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print_mail.admin.inc',
   );
 
   return $items;
 }
 
 /**
- * Implementation of hook_block_list().
+ * Implements hook_block_list().
  */
 function print_mail_block_list() {
       $block[0]['info'] = t('Most emailed');
@@ -102,7 +106,7 @@ function print_mail_block_list() {
 }
 
 /**
- * Implementation of hook_block_view().
+ * Implements hook_block_view().
  */
 function print_mail_block_view($delta = 0) {
       switch ($delta) {
@@ -123,12 +127,12 @@ function print_mail_block_view($delta = 0) {
 }
 
 /**
- * Implementation of hook_node_view().
+ * Implements hook_node_view().
  */
-function print_mail_node_view($node, $teaser) {
+function print_mail_node_view($node, $build_mode) {
   $print_mail_link_pos = variable_get('print_mail_link_pos', array(PRINT_MAIL_LINK_POS_DEFAULT => PRINT_MAIL_LINK_POS_DEFAULT));
   $print_mail_link_use_alias = variable_get('print_mail_link_use_alias', PRINT_MAIL_LINK_USE_ALIAS_DEFAULT);
-  $allowed_type = print_mail_link_allowed(array('type' => 'node', 'node' => $node, 'teaser' => $teaser));
+  $allowed_type = print_mail_link_allowed(array('type' => 'node', 'node' => $node, 'teaser' => ($build_mode == 'teaser')));
   if (($allowed_type) && !empty($print_mail_link_pos['link'])) {
     drupal_add_css(drupal_get_path('module', 'print') . '/css/printlinks.css');
     $links = array();
@@ -166,14 +170,14 @@ function print_mail_node_view($node, $teaser) {
     }
 
     $node->content['links']['print_mail'] = array(
-      '#type' => 'node_links',
-      '#value' => $links,
+      '#theme' => 'links',
+      '#links' => $links,
+      '#attributes' => array('class' => 'links inline'),
     );
   }
 
   // Insert content corner links
-  if (($teaser === FALSE) && !empty($print_mail_link_pos['corner']) &&
-      isset($node->build_mode) && ($node->build_mode == NODE_BUILD_NORMAL)) {
+  if (!empty($print_mail_link_pos['corner']) && ($build_mode == 'full')) {
     $link = print_mail_insert_link(NULL, $node);
     if ($link) {
       $node->content['print_links']['#markup'] = preg_replace('!</span>$!', $link . '</span>', $node->content['print_links']['#markup']);
@@ -182,7 +186,7 @@ function print_mail_node_view($node, $teaser) {
 }
 
 /**
- * Implementation of hook_help().
+ * Implements hook_help().
  */
 function print_mail_help($path, $arg) {
   $print_mail_link_pos = variable_get('print_mail_link_pos', array(PRINT_MAIL_LINK_POS_DEFAULT => PRINT_MAIL_LINK_POS_DEFAULT));
@@ -201,7 +205,7 @@ function print_mail_help($path, $arg) {
 }
 
 /**
- * Implementation of hook_node_load().
+ * Implements hook_node_load().
  */
 function print_mail_node_load($nodes, $types) {
   foreach ($nodes as $node) {
@@ -210,7 +214,7 @@ function print_mail_node_load($nodes, $types) {
 }
 
 /**
- * Implementation of hook_node_update().
+ * Implements hook_node_update().
  */
 function print_mail_node_update($node) {
   if (user_access('administer print') || user_access('node-specific print configuration')) {
@@ -219,7 +223,7 @@ function print_mail_node_update($node) {
 }
 
 /**
- * Implementation of hook_node_delete().
+ * Implements hook_node_delete().
  */
 function print_mail_node_delete($node) {
   db_delete('print_mail_node_conf')
@@ -231,9 +235,9 @@ function print_mail_node_delete($node) {
 }
 
 /**
- * Implementation of hook_form_alter().
+ * Implements hook_form_alter().
  */
-function print_mail_form_alter(&$form, $form_state, $form_id) {
+function print_mail_form_alter(&$form, &$form_state, $form_id) {
   // Add the node-type settings option to activate the mail version link
   if ((user_access('administer print') || user_access('node-specific print configuration')) &&
       (($form_id == 'node_type_form') || !empty($form['#node_edit_form']))) {
@@ -270,7 +274,7 @@ function print_mail_form_alter(&$form, $form_state, $form_id) {
 }
 
 /**
- * Implementation of hook_job_queue_functions().
+ * Implements hook_job_queue_functions().
  */
 function print_mail_job_queue_functions() {
   $functions['print_mail'] = array(
@@ -340,7 +344,7 @@ function _print_mail_node_conf_modify($nid, $link, $comments, $url_list) {
 function theme_print_mail_format_link() {
   $print_mail_link_class  = variable_get('print_mail_link_class', PRINT_MAIL_LINK_CLASS_DEFAULT);
   $print_mail_show_link = variable_get('print_mail_show_link', PRINT_MAIL_SHOW_LINK_DEFAULT);
-  $print_mail_link_text = variable_get('print_mail_link_text', t('Send to friend'));
+  $print_mail_link_text = filter_xss(variable_get('print_mail_link_text', t('Send to friend')));
 
   $img = drupal_get_path('module', 'print') . '/icons/mail_icon.gif';
   $title = t('Send this page by e-mail.');

print_pdf/print_pdf.install

@@ -9,14 +9,14 @@
  */
 
 /**
- * Implementation of hook_install().
+ * Implements hook_install().
  */
 function print_pdf_install() {
   drupal_install_schema('print_pdf');
 }
 
 /**
- * Implementation of hook_uninstall().
+ * Implements hook_uninstall().
  */
 function print_pdf_uninstall() {
   drupal_uninstall_schema('print_pdf');
@@ -49,7 +49,7 @@ function print_pdf_uninstall() {
 }
 
 /**
- * Implementation of hook_schema().
+ * Implements hook_schema().
  */
 function print_pdf_schema() {
   $schema['print_pdf_node_conf'] = array(

print_pdf/print_pdf.module

@@ -34,9 +34,9 @@ define('PRINT_PDF_XVFB_OPTIONS', '');
 //  define('PRINT_PDF_XVFB_OPTIONS', ' -fp /usr/share/fonts/X11/misc/,/usr/share/fonts/X11/Type1/,/usr/share/fonts/X11/75dpi/,/usr/share/fonts/X11/100dpi/');
 
 /**
- * Implementation of hook_perm().
+ * Implements hook_permission().
  */
-function print_pdf_perm() {
+function print_pdf_permission() {
   return array(
     'access PDF version' => array(
       'title' => t('Access the PDF version'),
@@ -46,7 +46,7 @@ function print_pdf_perm() {
 }
 
 /**
- * Implementation of hook_theme().
+ * Implements hook_theme().
  */
 function print_pdf_theme() {
   return array(
@@ -55,27 +55,33 @@ function print_pdf_theme() {
     ),
     'print_pdf_dompdf_footer' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
     'print_pdf_tcpdf_header' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
     'print_pdf_tcpdf_page' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
     'print_pdf_tcpdf_content' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
     'print_pdf_tcpdf_footer' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
     'print_pdf_tcpdf_footer2' => array(
       'arguments' => array(),
+      'file' => 'print_pdf.pages.inc',
     ),
   );
 }
 
 /**
- * Implementation of hook_menu().
+ * Implements hook_menu().
  */
 function print_pdf_menu() {
   $items = array();
@@ -85,6 +91,7 @@ function print_pdf_menu() {
     'page callback' => 'print_pdf_controller',
     'access arguments' => array('access PDF version'),
     'type' => MENU_CALLBACK,
+    'file' => 'print_pdf.pages.inc',
   );
   $items[PRINTPDF_PATH . '/' . PRINTPDF_PATH] = array(
     'page callback' => 'drupal_access_denied',
@@ -96,6 +103,7 @@ function print_pdf_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 3,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print_pdf.admin.inc',
   );
   $items['admin/settings/print/pdf/options'] = array(
     'title' => 'Options',
@@ -109,13 +117,14 @@ function print_pdf_menu() {
     'access arguments'  => array('administer print'),
     'weight' => 2,
     'type' => MENU_LOCAL_TASK,
+    'file' => 'print_pdf.admin.inc',
   );
 
   return $items;
 }
 
 /**
- * Implementation of hook_block_list().
+ * Implements hook_block_list().
  */
 function print_pdf_block_list() {
       $block[0]['info'] = t('Most PDFd');
@@ -123,7 +132,7 @@ function print_pdf_block_list() {
 }
 
 /**
- * Implementation of hook_block_view().
+ * Implements hook_block_view().
  */
 function print_pdf_block_view($delta = 0) {
       switch ($delta) {
@@ -144,7 +153,7 @@ function print_pdf_block_view($delta = 0) {
 }
 
 /**
- * Implementation of hook_requirements().
+ * Implements hook_requirements().
  */
 function print_pdf_requirements($phase) {
   $requirements = array();
@@ -167,12 +176,12 @@ function print_pdf_requirements($phase) {