#200777 by JirkaRybka: theme settings form relied on _POST[] and stored irrelevant formapi keys as theme settings

1 files changed, 6 insertions, 7 deletions

diff --git a/modules/system/system.admin.inc b/modules/system/system.admin.inc
index 9505ad1c3..027f9b0f6 100644
--- a/modules/system/system.admin.inc
+++ b/modules/system/system.admin.inc
@@ -537,18 +537,17 @@ function system_theme_settings(&$form_state, $key = '') {
  * Process system_theme_settings form submissions.
  */
 function system_theme_settings_submit($form, &$form_state) {
-  $op = isset($_POST['op']) ? $_POST['op'] : '';
-  $key = $form_state['values']['var'];
+  $values = $form_state['values'];
+  $key = $values['var'];
 
-  // Exclude unnecessary elements.
-  unset($form_state['values']['var'], $form_state['values']['submit'], $form_state['values']['reset'], $form_state['values']['form_id']);
-
-  if ($op == t('Reset to defaults')) {
+  if ($values['op'] == t('Reset to defaults')) {
     variable_del($key);
     drupal_set_message(t('The configuration options have been reset to their default values.'));
   }
   else {
-    variable_set($key, $form_state['values']);
+    // Exclude unnecessary elements before saving.
+    unset($values['var'], $values['submit'], $values['reset'], $values['form_id'], $values['op'], $values['form_build_id'], $values['form_token']);
+    variable_set($key, $values);
     drupal_set_message(t('The configuration options have been saved.'));
   }