#358437 follow-up by David_Rothstein, sun, chx: Disallow invalid text format IDs; force 0 and non-existant formats to NULL.

2 files changed, 34 insertions, 8 deletions

diff --git a/modules/block/block.install b/modules/block/block.install
index 1a6ec333a..b45c5e5e2 100644
--- a/modules/block/block.install
+++ b/modules/block/block.install
@@ -156,9 +156,8 @@ function block_schema() {
       ),
       'format' => array(
         'type' => 'int',
-        'size' => 'small',
-        'not null' => TRUE,
-        'default' => 0,
+        'unsigned' => TRUE,
+        'not null' => FALSE,
         'description' => 'The {filter_format}.format of the block body.',
       ),
     ),
@@ -189,6 +188,19 @@ function block_install() {
 }
 
 /**
+ * Implements hook_update_dependencies().
+ */
+function block_update_dependencies() {
+  // Block update 7005 needs to query the list of existing text formats and
+  // therefore must run after filter_update_7000().
+  $dependencies['block'][7005] = array(
+    'filter' => 7000,
+  );
+
+  return $dependencies;
+}
+
+/**
  * @defgroup updates-6.x-to-7.x Block updates from 6.x to 7.x
  * @{
  */
@@ -397,13 +409,25 @@ function block_update_7004() {
  * Update the {block_custom}.format column.
  */
 function block_update_7005() {
-  // It was previously possible for a value of "0" to be stored in database
-  // tables to indicate that a particular piece of text should be filtered
-  // using the default text format.
+  // For an explanation of these updates, see the code comments in
+  // user_update_7010().
+  db_change_field('block_custom', 'format', 'format', array(
+    'type' => 'int',
+    'unsigned' => TRUE,
+    'not null' => FALSE,
+    'description' => 'The {filter_format}.format of the block body.',
+  ));
+  db_update('block_custom')
+    ->fields(array('format' => NULL))
+    ->condition('body', '')
+    ->condition('format', 0)
+    ->execute();
+  $existing_formats = db_query("SELECT format FROM {filter_format}")->fetchCol();
   $default_format = variable_get('filter_default_format', 1);
   db_update('block_custom')
     ->fields(array('format' => $default_format))
-    ->condition('format', 0)
+    ->isNotNull('format')
+    ->condition('format', $existing_formats, 'NOT IN')
     ->execute();
 }
 
diff --git a/modules/block/block.module b/modules/block/block.module
index ba2f8001d..3a0be2520 100644
--- a/modules/block/block.module
+++ b/modules/block/block.module
@@ -219,10 +219,12 @@ function block_block_info() {
  * Implements hook_block_configure().
  */
 function block_block_configure($delta = 0) {
-  $custom_block = array('format' => filter_default_format());
   if ($delta) {
     $custom_block = block_custom_block_get($delta);
   }
+  else {
+    $custom_block = array();
+  }
   return block_custom_block_form($custom_block);
 }